Pwszbot

Overview

Trojan:Win32/Pwszbot (a blend of Password Stealer and Zbot/Zeus functionalities) is a highly sophisticated, modular banking trojan and information stealer. It is designed to act as a persistent botnet agent, silently harvesting a massive variety of sensitive data, intercepting web sessions, and granting remote attackers persistent access to the compromised machine. It shares significant code similarities and operational tactics with the infamous Zeus banking trojan.

Understanding Pwszbot (Banking Trojans)
To an end-user, a Pwszbot infection is completely invisible; they can use their computer and browse the internet normally. For a financial institution, it represents a critical threat capable of defeating standard anti-fraud measures. Because it acts as a 'Man-in-the-Browser', it can alter what the user sees on their screen during a banking session, intercepting two-factor authentication codes and manipulating transactions in real-time.

Execution and Credential Harvesting Mechanics
Pwszbot is typically distributed via sophisticated spear-phishing campaigns (often using macros or exploit documents) (`T1566.001`). Upon execution, it drops a highly obfuscated payload into a random `AppData` subdirectory (`T1027`). It establishes persistence by modifying Registry Run keys or creating hidden scheduled tasks (`T1547.001`). The core functionality involves deep process injection (`T1055`), specifically targeting web browsers (`iexplore.exe`, `chrome.exe`, `firefox.exe`). Once injected, it performs 'Web Injects' (`T1185`): when the user visits a targeted banking URL (retrieved from a configuration file downloaded from the C2 server), the trojan dynamically modifies the HTML/JavaScript of the page, presenting fake login forms or transaction authorization prompts directly to the user.

Indicators of Compromise & Impact
The impact is catastrophic financial fraud and total credential compromise. Host-based IoCs include EDR alerts for 'Suspicious Process Hollowing' or 'API Hooking' targeting major web browsers. Network IoCs include encrypted beaconing traffic to known botnet C2 panels, and the downloading of encrypted configuration files (`.bin` or `.cfg` files containing the targeted bank URLs).

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1185: Enforce strong MFA and use browser isolation or hardened browsers for sensitive financial or administrative portals to defeat session hijacking.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_PWSZBOT {
    meta:
        description = "Detects Pwszbot (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "pwszbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Pwszbot Activity
id: aad8b20cc2e3cec3063e7c84cd791f4c
status: experimental
description: Detects generic indicators of the pwszbot malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*pwszbot*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate the endpoint from the network to sever the C2 connection and prevent the attacker from initiating fraudulent transactions or deploying further modules.
2. Contact the victim's financial institutions immediately to freeze accounts and alert them to the high probability of a Man-in-the-Browser compromise.
3. Assume all web credentials stored on or entered into the machine have been stolen, and mandate enterprise-wide password resets.
4. Capture a live memory image (RAM dump) to extract the decrypted Pwszbot configuration file, which will reveal exactly which banks and URLs the malware was targeting.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not rely on standard MFA (like SMS codes) to protect accounts if a banking trojan is suspected, as the attacker is actively intercepting those codes.
2. Avoid simply running an AV scan and leaving the machine online; banking trojans require a complete wipe and reimage to ensure the deep API hooks are removed.

References & External Analysis

• Search "pwszbot" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Gametool
• Rockrat
• Polip
• Elemental
• Delfinject

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/pwszbot.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.