Zeroaccess
MITRE ATT&CK: S0027 View on attack.mitre.org
Aliases: Max++, Sirefef, Smiscer, ZAccess
- First seen
- 2011-07-01 00:00:00
- Malware type
- rootkit, botnet
- Family
- Malware family
- Related IoCs
- 170 (97 malicious)
- Last IoC activity
- 2026-10-18 03:21:19
- Profile updated
- 2026-07-07 14:44:20
Context
Zeroaccess is a kernel-mode Rootkit that attempts to add victims to the ZeroAccess botnet, often for monetary gain.
Recent IoC activity
97 malicious indicators in Maltiverse are attributed to Zeroaccess (S0027). The 20 most recently updated:
| Type | Indicator | Updated | Sources |
|---|---|---|---|
| IP address | 178.16.54.109 | 2026-10-15 | 4 |
| file sample | 3f7e450f3bb2cdbeec4d727fd1320449ff7f4a260b89299d70d468db14e2e253 | 2026-10-15 | 1 |
| IP address | 88.254.253.254 | 2026-10-14 | 3 |
| IP address | 46.63.142.47 | 2026-10-14 | 2 |
| IP address | 27.4.103.111 | 2026-10-14 | 3 |
| IP address | 94.180.223.239 | 2026-10-14 | 2 |
| IP address | 85.178.119.1 | 2026-10-14 | 2 |
| IP address | 123.108.200.206 | 2026-10-14 | 2 |
| IP address | 41.70.180.118 | 2026-10-14 | 2 |
| IP address | 190.27.129.8 | 2026-10-14 | 2 |
| IP address | 93.108.106.38 | 2026-10-14 | 2 |
| IP address | 190.254.253.254 | 2026-10-14 | 3 |
| IP address | 201.74.16.30 | 2026-10-14 | 2 |
| IP address | 94.189.241.130 | 2026-10-14 | 2 |
| IP address | 14.99.48.140 | 2026-10-14 | 2 |
| IP address | 83.97.238.80 | 2026-10-14 | 2 |
| IP address | 124.123.69.213 | 2026-10-14 | 2 |
| IP address | 14.99.226.207 | 2026-10-14 | 2 |
| IP address | 93.183.166.89 | 2026-10-14 | 2 |
| IP address | 118.94.118.244 | 2026-10-14 | 2 |
Detection coverage
- 1 YARA rules
- 23 Sigma rules
Malware & tools used
- Rootkit (attack-pattern)
- NTFS File Attributes (attack-pattern)
Detection rules
- MALPEDIA_Win_Zeroaccess_Auto (yara-rule)
Reports & references
- virusbulletin.com — Paper Notes Click Fraud American Story (report)
- researchgate.net — Botnet Protocol Inference In The Presence Of Encrypted Traffic (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Zeroaccess (report)
- resources.infosecinstitute.com — Zeroaccess Malware Part 3 The Device Driver Process Injection Rootkit (report)
- blog.malwarebytes.com — Sophos Discovers Zeroaccess Using Rlo (report)
- resources.infosecinstitute.com — Step By Step Tutorial On Reverse Engineering Malware The Zeroaccessmaxsmiscer Crimeware Rootkit (report)
- blog.malwarebytes.com — Zeroaccess Anti Debug Uses Debugger (report)
- malwaretips.com — Zeroaccess Analysis Pdf.606 (report)
- contagiodump.blogspot.com — Zeroaccess Sirefef Rootkit 5 Fresh (report)
- resources.infosecinstitute.com — Zeroaccess Malware Part 2 The Kernel Mode Device Driver Stealth Rootkit (report)
- Broadcom/Symantec — Zeroaccess Indepth 13 En (report)
- contagiodump.blogspot.com — Zeroaccess Max Smiscer Crimeware (report)
- resources.infosecinstitute.com — Zeroaccess Malware Part 4 Tracing The Crimeware Origins By Reversing Injected Code (report)
- MITRE ATT&CK — S0027 (report)
- sophosnews.files.wordpress.com — Zeroaccess2 (report)