Zloader

Aliases: DELoader, SILENTNIGHT, Terdot

First seen
2016-05-01 00:00:00
Malware type
loader, trojan, credential-stealer
Family
Malware family
Related IoCs
165 (157 malicious)
Last IoC activity
2026-10-18 02:32:15
Profile updated
2026-07-07 12:58:15

Targeted industries: financial-services

Context

This family describes the (initially small) loader, which downloads Zeus OpenSSL. In June 2016, a new loader was dubbed DEloader by Fortinet. It has some functions borrowed from Zeus 2.0.8.9 (e.g. the versioning, nrv2b, binstorage-labels), but more importantly, it downloaded a Zeus-like banking trojan (-> Zeus OpenSSL). Furthermore, the loader shared its versioning with the Zeus OpenSSL it downloaded. The initial samples from May 2016 were small (17920 bytes). At some point, visualEncrypt/Decrypt was added, e.g. in v1.11.0.0 (September 2016) with size 27648 bytes. In January 2017 with v1.15.0.0, obfuscation was added, which blew the size up to roughly 80k, and the loader became known as Zloader aka Terdot. These changes may be related to the Moskalvzapoe Distribution Network, which started the distribution of it at the same time. Please note that IBM X-Force decided to call win.zloader/win.zeus_openssl "Zeus Sphinx", after mentioning it as "a new version of Zeus Sphinx" in their initial post in August 2016. Malpedia thus lists the alias "Zeus XSphinx" for win.zeus_openssl - the X to refer to IBM X-Force.

Detection coverage

  • 7 YARA rules

Used by threat actors

  • Zloader & Ursnif Affiliate Campaign 2020-22 (campaign)

Detection rules

  • CAPE_Zloader_1 (yara-rule)
  • CAPE_Zloader2024 (yara-rule)
  • CAPE_Zloader2025 (yara-rule)
  • CAPE_Zloader (yara-rule)
  • CAPE_Zloader_2024 (yara-rule)
  • SIGNATURE_BASE_MAL_DOC_Zloader_Oct20_1 (yara-rule)
  • RUSSIANPANDA_Win_Mal_Zloader (yara-rule)

Reports & references

  • CISA — Aa22 110A (report)
  • CrowdStrike — Report2021Gtr (report)
  • bleepingcomputer.com — Fake Microsoft Teams Updates Lead To Cobalt Strike Deployment (report)
  • zdnet.com — The Malware That Usually Installs Ransomware And You Need To Remove Right Away (report)
  • labs.sentinelone.com — Enter The Maze Demystifying An Affiliate Involved In Maze Snow (report)
  • Microsoft — Dismantling Zloader How Malicious Ads Led To Disabled Security Tools And Ransomware (report)
  • guidepointsecurity.com — From Zloader To Darkside A Ransomware Story (report)
  • medium.com — Inside View Of Brazzzersff Infrastructure 89B9188Fd145 (report)
  • ptsecurity.com — Paas Or How Hackers Evade Antivirus Software (report)
  • web.archive.org — Otchet Kompanii Group Ib Ransomware Uncovered 2020 2021 (report)
  • cronup.com — De Ataque Con Malware A Incidente De Ransomware (report)
  • Cisco Talos — 2020 Year In Malware (report)
  • decoded.avast.io — Avast Q2 2022 Threat Report (report)
  • blog.malwarebytes.com — Malsmoke Operators Abandon Exploit Kits In Favor Of Social Engineering Scheme (report)
  • cloud.google.com — Unc4393 Goes Gently Into Silentnight (report)
  • cisoclub.ru — Otchet Kompanii Group Ib Ransomware Uncovered 2020 2021 (report)
  • deepinstinct.com — Deep Dive Packing Software Cryptone (report)
  • mal-eats.net — Campo New Attack Campaign Targeting Japan (report)
  • mal-eats.net — Campo New Attack Campaign Targeting Japan (report)
  • lac.co.jp — 20201106 002321 (report)
  • zscaler.com — Inside Zloader S Latest Trick Dns Tunneling (report)
  • decoded.avast.io — Zloader The Silent Night (report)
  • CrowdStrike — Duck Hunting With Falcon Complete Qakbot Zip Based Campaign (report)
  • Microsoft — Zloader Botnet Disrupted Malware Ukraine (report)
  • 0xc0decafe.com — Detect Rc4 In Malicious Binaries (report)

External references