ZBot (also known as Zeus, ZeusBot or WSNPoem) is a popular trojan engineered to steal sensitive data from compromised computers. Zeus was reported to be attacking the Verified by Visa and MasterCard SecureCode verification systems introduced in recent years by spoofing Visa and MasterCard enrollment screen. The latest variants can also gather the history of the visited Web sites and other data, which users provide online, while also capturing screenshots of the their desktop.

How ZBot works?

Zbot is known to be distributed mainly via the spam email campaigns and web pages which hosts the trojan. The latest campaign was morphing the LinkedIn login page. Once installed, ZBot modifies the files and folders’ structure, adds registry keys, injects code into several processes like winlogon.exe or svchost.exe, and adds exceptions to the Microsoft Firewall providing backdoor and server capabilities. It also sends sensitive information and listens on several ports for possible commands from the remote attackers’ command-and-control center. Unfortunately many of the antivirus tools (free as well as paid ones) fail to catch the Zbot trojan all the time. This may be due to the ever-growing list of variants of the trojan.

ZBot Removal Tool

0 Comments Read More