{
  "family": "zlob",
  "sample_count": 15,
  "category": "trojan",
  "description": "TrojanDownloader:Win32/Zlob (also known as the Zlob Trojan or Mac DNS Changer) is a historically massive and foundational malware family that peaked in the late 2000s. Zlob is infamous for pioneering the 'Fake Codec' drive-by download lure. It was primarily used to build a massive botnet dedicated to downloading and installing highly aggressive Rogue Security Software (Scareware) and adware onto victim machines.<br><br><b>Understanding the Zlob Trojan</b><br>To a victim, a Zlob infection typically began while browsing adult websites or attempting to download pirated movies. The user would click a video link and receive a highly realistic prompt stating, 'You need to download the latest ActiveX Video Codec to view this content.' Clicking 'OK' downloaded the Zlob trojan. For security analysts, Zlob represents the industrialization of the Pay-Per-Install (PPI) scareware ecosystem. It relied entirely on social engineering (`T1204.002`) rather than software exploits.<br><br><b>Execution and the Scareware Pipeline</b><br>Upon execution of the fake codec installer, Zlob establishes deep persistence, often dropping randomly named DLLs into the `System32` directory and registering them as Browser Helper Objects (BHOs) or utilizing the `Winlogon\\Notify` registry key (`T1547`). Its primary function is a downloader (`T1105`). It silently reaches out to its C2 infrastructure and begins pulling down a barrage of secondary payloads. These payloads were almost exclusively aggressive Rogue Antivirus programs (like SpywareQuake or Microsoft Antispyware 2009) that would flood the user's screen with fake alerts (`T1491`) demanding credit card payments. Advanced variants (like the DNS Changer variant) altered the system's DNS settings (`T1562.001`) to redirect all web traffic through attacker-controlled servers.<br><br><b>Indicators of Compromise & Impact</b><br>The impact was total system hijacking by scareware and potential financial fraud. Incident responders would observe massive, chaotic outbound HTTP traffic as Zlob downloaded its payloads. EDR logs would flag the creation of numerous unexpected DLLs in system directories and unauthorized modifications to the `Winlogon` registry keys.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1204.002",
    "T1491",
    "T1105",
    "T1547",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File (Fake Codec)",
      "tactic": "Execution"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547",
      "name": "Boot or Logon Autostart Execution (Winlogon/BHO)",
      "tactic": "Persistence"
    },
    {
      "id": "T1491",
      "name": "Defacement (UI Manipulation via Scareware)",
      "tactic": "Impact"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses (DNS Hijacking)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Boot the infected machine into 'Safe Mode with Networking' to bypass the malware's autostart mechanisms and fake AV blockers.",
    "Check and reset the system's DNS settings (IPv4 properties) to ensure traffic is not being routed through malicious servers.",
    "Utilize a standalone, reputable malware removal tool to scan the system, specifically targeting the `System32` directory and BHO registry keys.",
    "Advise the end-user NOT to enter their credit card information into any of the aggressive pop-up warnings."
  ],
  "what_to_avoid": [
    "Do not trust the 'Antivirus' software demanding payment; it is the secondary payload dropped by Zlob.",
    "Avoid attempting manual removal of Zlob DLLs while the OS is running normally, as they are often injected into `explorer.exe` and cannot be deleted."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}