Got Zbot?

ronjor · Mar 15, 2010

PWS:Win32/Zbot a.k.a Zeus/WSNPoem is a password-stealing trojan that monitors for visits to certain Web sites. It allows limited backdoor access and control and may terminate certain security-related processes.

In our collection, although we have some Win32/Zbot malware toolkit/builder samples that date back to the 1st quarter of 2008, we already received and created detections for a number of Win32/Zbot samples from earlier - as early as the last quarter of 2006 (an early SHA1 is 006227158415078de14b4fe889dfe8dedfcf4e0b).

Win32/Zbot evolves as it is circulated and maintained by a number of malicious and unrelated distributors, who use varying distribution vectors (spam run, drive-by-downloads, exploits, etc.). Which, mind you, explains why this critter has weathered more than 3 years and is still around and active. If you have been infected by this malware, well suffice it to say that you are not alone. Our telemetry shows Win32/Zbot infections reported back by a number of our services have rocketed sky high as of late.
Click to expand...

Microsoft Malware Protection Center

G1111 · Mar 15, 2010

ronjor said:

Microsoft Malware Protection Center
Click to expand...

Interesting. At least MS made a dent in the botnet network. Thanks Ron.

elapsed · Mar 15, 2010

G1111 said:

Interesting. At least MS made a dent in the botnet network. Thanks Ron.
Click to expand...

They've been doing that a lot lately, gogo MS!

What we know (and learned) from the Waledac takedown

Log in or Sign up

Got Zbot?

ronjor Global Moderator

G1111 Registered Member

elapsed Registered Member

Log in or Sign up

Got Zbot?

ronjor Global Moderator

G1111 Registered Member

elapsed Registered Member

Useful Searches