Zbot

Zbot is a Windows banking trojan and information-stealing malware family, also referred to in vendor detections as Trojan.Zbot, Win32/Zbot, Trojan-Spy.Win32.Zbot, PWS-Zbot, and related banker/infostealer names. The provided content states that it attempts to steal confidential information from compromised computers and can download configuration files and updates from the Internet. It is described as affecting Windows systems, including legacy desktop and server versions such as Windows 95, 98, Me, NT, 2000, XP, Vista, and Windows Server 2003.

The content places Zbot among the top banking trojan and information stealer families observed in Asia and the South Pacific in INTERPOL’s 2025/2026 cyberthreat assessment. It is also described in multiple intrusion chains as a follow-on payload delivered by exploit kits and social-engineering operations. Specifically, the content says the Impact Exploit Kit delivered a payload assessed as Zbot, and another exploit-kit analysis notes a payload that may have been Zbot or Citadel. The content also states that newer CryptoLocker campaigns often involved prior Zbot infection that subsequently installed CryptoLocker. In Rapid7 reporting on Black Basta-linked social-engineering activity in 2024, operators commonly executed loaders such as Zbot, explicitly noted there as Zloader, after credential harvesting.

Behavior and execution details directly mentioned in the content include downloading configuration files and updates from the Internet, use as a loader/follow-on payload after initial access, and persistence/activity indicators associated with Zbot-linked CryptoLocker delivery such as a registry key under HKCU\Software\Microsoft<random>, droppers in %Temp%, and a startup entry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run. In the Rapid7 case, a Zbot/Zloader sample named SyncSuite.exe with SHA256 DB34E255AA4D9F4E54461571469B9DD53E49FEED3D238B6CFB49082DE0AFB1E4 was observed copying itself to a random folder under %APPDATA%, persisting via HKCU\Software\Microsoft\Windows\CurrentVersion\Run or a scheduled task named after the executable, loading a fresh copy of ntdll.dll to avoid hooking, and performing process hollowing into msedge.exe using NTAPI functions.

Associated activity in the content includes delivery by exploit kits, phishing-linked malware chains, credential-harvesting operations, and ransomware enablement. Threat associations directly mentioned include Black Basta operators using Zbot/Zloader as a follow-on loader, and historical linkage to CryptoLocker installation after Zbot infection. High-confidence observables mentioned in the content include the sample hash DB34E255AA4D9F4E54461571469B9DD53E49FEED3D238B6CFB49082DE0AFB1E4 for SyncSuite.exe and the registry/persistence paths noted above.