Black friday Up to 3 extra licenses FOR FREE + Special offer for TI LOOKUP Get it now
Webinar
February 26
Better SOC with Interactive Sandbox Practical Use Cases
Register now
83
Global rank
75 infographic chevron month
Month rank
70 infographic chevron week
Week rank
0
IOCs

Zloader is a banking trojan that uses webinjects and VNC clients to still banking credentials. This Trojan is based on leaked code from 2011, but despite its age, Zloader’s popularity has been only increasing through early 2020, when it relied on COVID-19 themed attacks.

Banking trojan
Type
Unknown
Origin
1 May, 2016
First seen
21 September, 2025
Last seen
Also known as
Terdot
Zbot
DELoader

How to analyze Zloader with ANY.RUN

Banking trojan
Type
Unknown
Origin
1 May, 2016
First seen
21 September, 2025
Last seen

IOCs

IP addresses
104.18.56.236
104.18.57.236
31.184.254.191
Hashes
aa15dcae6420ee9b09c8ce7538690a88439f2377e915f72dc0a8c43f2d649401
d8495ddaa8b21c9bfe0900bcaadbae6506bfa49960fa5ac85231755a644e4072
a77dd89d4436b5a2bdb7ef73bbd6869cca4a06307f66854a842219cadc5761dd
ae251738df5c64d1ff59945c089678436eb913f41736344ce2312dae2ef9aa74
65ce4d7c14bc5b52e4cc493eeb1bf058b31eddbc7b48dc572121f6fac2f9c131
978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
f58946c62ee0e48d263759c223006166fd9565ab2eeac7fda9d3a349824c6c53
85a05aef068827cfe295f86ebd2f1e32e080adc81793a3c391e8130d3d3db343
0e6244f5a66eec71b8a07ffd8fbecc615e168148690fa7b06b77c4f0fe60359e
630c8716d8637dfe39ca156251a7caecd0d3290108743681828b299d0ec00343
d8738f33ba1654a057acd0afa83cd1fad5dc0e2edee6e9c381dbf1f6bb0eb44a
04fc25369aa79c99f817ec025ad70a5f4cd9e1503c499e5ec42ec5f92e23c9a4
cc9dceb78d2d6110d3d5f5009cc6346cdc25554d165363894c47ff14a5a62b41
75075889cfc6b20dae13534b3affb95d35731fc457b277bd3ed4288cdf74b2d3
ecc97eec7f6dc5e0cf561d0b9a250e6d52b5d99f89dab756343cb8a3d951d174
f8489a87a28e5d12334922821224101292e149cbfce99d2a8c027f537c08761c
56bcc790f56089fbd347ef793e3b5133bec111111df005ea18196797a79a8699
e97feae192044a82a2ac47d9083dcc9836370fbc58781bb7e8e8625339164f66
ff285dbb139fe185f00e1165da71182dedb8ea7a9548581e6aad2492b6df511e
35cc9403db2b12cb186c02f48fed8ffdeb31fc28de8a7d1192e1158f1039a47e
Domains
domain3.com
domain4.com
metagro.com.br
magic-place.fr
velocitii.com
hongsamlinhchi.vn
rkexqgflnsnepgdxqgfj.com
qbwpdqfwrtgyhwtxvcyg.com
URLs
https://aogmphregion.org.za/construction.php
https://eagle-family.co.uk/panel.php
https://despautyajobssooka.ml/wp-smarts.php
https://construbienesjg.com/wp-punch.php
https://khanbuilders.uk/wp-punch.php
https://aayanent.com/backups.php
https://acquaie.com/post.php
https://patatai.com/post.php
https://noifatemmuce.tk/post.php
https://asdfghdsajkl.com/gate.php
https://eiqwuggejqw.com/gate.php
https://lkjhgfgsdshja.com/gate.php
https://kdjwhqejqwij.com/gate.php
https://daksjuggdhwa.com/gate.php
https://dkisuaggdjhna.com/gate.php
https://kjdhsasghjds.com/gate.php
https://iasudjghnasd.com/gate.php
https://djshggadasj.com/gate.php
https://dquggwjhdmq.com/gate.php
http://marchadvertisingnetwork2.com/post.php
Last Seen at

Recent blog posts

post image
Efficient SOC: How to Detect and Solve Incide...
watchers 556
comments 0
post image
ANY.RUN & Palo Alto Networks Cortex XSOAR...
watchers 655
comments 0
post image
Lazarus Group Attacks in 2025: Here's Everyth...
watchers 4063
comments 0

What is Zloader?

Zloader, also known as Terdot and Zbot is a banking trojan. It uses web injects to steal passwords and auth codes of its victims. The trojan was first spotted in 2016 but it has seen a sudden surge of activity in the winter of 2019, appearing in over 100 email campaigns.

Zloader is constructed using the leaked code of the well-known ZeuS malware. ZeuS code was made public in 2011 and became a base for various malware samples. The fact that its variants are still being used goes to show how effective the original malware was.

General description of Zloader malware

Researchers first observed Zloader, also known at the time as DELoader, in 2016, when it started attacking Canadian banking organizations. The malware’s name highlights two facts: the letter “Z” shows that it is based on the Zeus Banking Trojan and the word “loader” highlights the malware’s unique design. Zloader makes its way into the machines of the victims using a loader that installs the final payload.

Zloader became quite popular and served as the main tool for several hackers, with TA511 also known as Hancitor being the most acknowledged. After working with Zloader for almost 2 years, Hancitor made a jump to Panda Banker. Others soon followed suit and Zloader became abandoned until 2019, when researchers detected a sudden surge of attacks.

Possibly, attackers pursued the opportunity presented with the confusion that surrounds the COVID crisis, launching a new wave of campaigns in December 2019, with the number of sightings only increasing by March 2020.

Although, previously Zloader focused on finding victims in Canada, starting with 2020 it expanded the geography of operations. The newer campaigns attack financial institutions all over the world, including the US, Australia, and Europe.

The malware uses a technique called web injects to trick victims into revealing their authentication codes. Zloader replaces the banking website of the victim with an identical copy fetched from a custom file so that unsuspecting users give away credentials thinking that they are logging into their bank. In reality, the sensitive information, including auth codes, is sent to the C&C controlled by the attackers.

Additionally, Zloader can fetch information from browsers, accessing cookies and passwords — a standard functionality for banking trojans.

Interestingly, the 2019 version of Zloader is less advanced than its predecessor, seen in 2016. Researchers think that it might be a revision of an older iteration of the malware that lacked some of the sophisticated malicious techniques.

Among the missing features are code obfuscation and string encryption — those are both techniques threat actors use to complicated static analysis of malware by making the code unreadable.

However, that does not mean that Zloader should be taken lightly. It's still top-level malware and it is highly dangerous.

For example, if attackers manage to get a hold of the credentials, they use a smart technique to log into the account without raising red flags with the bank. The threat actors log in with a virtual network computing client, so all the bank sees is another session from the normal victim’s machine. This way, not only can attackers withdraw money without raising any alarms but proving that the transaction fraudulence is also difficult.

On top of that, the malware still uses some anti-evasion techniques like Command & Control blacklisting and Windows API function hashing, making the analysis more complicated. Another worrying sign is the constant maintenance of Zloader. No less than 18 versions have been seen circulating in the wild from January to March 2020. The malware is being constantly improved.

Zloader malware analysis

We can watch the complete execution process of Zloader in a video recorded in the ANY.RUN interactive malware hunting service. Moreover, check out other malware analyses such as FlawedAmmyy.

Zloader process graph

Figure 1: Shows the process graph, automatically created in ANY.RUN

Zloader execution process

Zloader usually makes its way into systems as an executable or as a script file. When entering as a script file, it runs and compiles into the library by the wscript process. As an executable file, the malware makes an injection into the msiexec.exe process. After that Zloader tries to connect to Command & Control server over HTTPS to download additional modules.

Zloader distribution

Zloader is distributed to victims with malspam. Emails are crafted to look like government notices or financial support offered due to the COVID-19 epidemic. Attached to emails are malicious files, normally with Microsoft Office file extensions, but PDF files were also observed.

When opened, the files ask the victim to enable macros. If users compile, the macros download a loader that establishes a connection with the command and control server and installs the final payload — Zloader.

How to detect Zloader?

Since Zloader creates registry keys with pseudo-random names under HKEY_CURRENT_USER\Software\Microsoft and directories with pseudo-random names inside the %APPDATA% directory. This activity can help analysts detect this malware family. To take a look at the registry changes and created directories, just click on the msiexec process and then click on the “More info” button.

Conclusion

Despite being based on code that was leaked no less than 9 years ago, Zloader still poses a massive threat to cybersecurity.

From late 2019, this banking trojan targets financial institutions all around the world with COVID-19 themed attacks. It appeared in over 100 email campaigns after being inactive for nearly 2 years and now wreaks havoc on the banking world, using web injects and VNC sessions to steal credentials.

Thankfully, using ANY.RUN, researchers can analyze Zloader in a secure online environment and take advantage of our interactive sandbox. With our service, malware hunters can get results on the fly, while still being in control of all simulation variables, saving massive time on dynamic analysis. Studying threats like Zloader is a sure way to develop a sound cybersecurity strategy or prepare an action plan should your organization come under attack.

HAVE A LOOK AT

StrelaStealer screenshot
StrelaStealer
strela
StrelaStealer is a malware that targets email clients to steal login credentials, sending them back to the attacker’s command-and-control server. Since its emergence in 2022, it has been involved in numerous large-scale email campaigns, primarily affecting organizations in the EU and U.S. The malware’s tactics continue to evolve, with attackers frequently changing attachment file formats and updating the DLL payload to evade detection.
Read More
WarmCookie screenshot
WarmCookie
badspace
WarmCookie is a backdoor malware that cyber attackers use to gain initial access to targeted systems. It is often distributed through phishing emails, frequently using job recruitment lures to entice victims into downloading and executing the malware.
Read More
Arechclient2 screenshot
Arechclient2
arechclient2
The Arechclient2 malware is a sophisticated .NET-based Remote Access Trojan (RAT) that collects sensitive information, such as browser credentials, from infected computers. It employs various stealth techniques, including Base64 encoding to obscure its code and the ability to pause activities to evade automated security tools. The malware also can adjust Windows Defender settings and uses code injection to manipulate legitimate processes.
Read More
Wshrat screenshot
Wshrat
wshrat rat trojan
WSHRAT is a Remote Access Trojan — a malware that allows the attackers to take over the infected machines. The RAT has been in circulation since 2013 and it is arguably most notable for the numerous versions released into the wild.
Read More
DarkGate screenshot
DarkGate
darkgate
DarkGate is a loader, which possesses extensive functionality, ranging from keylogging to crypto mining. Written in Delphi, this malware is known for the use of AutoIT scripts in its infection process. Thanks to this malicious software’s versatile architecture, it is widely used by established threat actors.
Read More
Mallox screenshot
Mallox
mallox
Mallox is a ransomware strain that emerged in 2021, known for its ability to encrypt files and target database servers using vulnerabilities like RDP. Often distributed through phishing campaigns and exploiting exposed SQL servers, it locks victims' data and demands a ransom. Mallox operates as a Ransomware-as-a-Service (RaaS), making it accessible to affiliates who use it to conduct attacks.
Read More