{
  "family": "pwszbot",
  "sample_count": 4,
  "category": "trojan",
  "description": "Trojan:Win32/Pwszbot (a blend of Password Stealer and Zbot/Zeus functionalities) is a highly sophisticated, modular banking trojan and information stealer. It is designed to act as a persistent botnet agent, silently harvesting a massive variety of sensitive data, intercepting web sessions, and granting remote attackers persistent access to the compromised machine. It shares significant code similarities and operational tactics with the infamous Zeus banking trojan.<br><br><b>Understanding Pwszbot (Banking Trojans)</b><br>To an end-user, a Pwszbot infection is completely invisible; they can use their computer and browse the internet normally. For a financial institution, it represents a critical threat capable of defeating standard anti-fraud measures. Because it acts as a 'Man-in-the-Browser', it can alter what the user sees on their screen during a banking session, intercepting two-factor authentication codes and manipulating transactions in real-time.<br><br><b>Execution and Credential Harvesting Mechanics</b><br>Pwszbot is typically distributed via sophisticated spear-phishing campaigns (often using macros or exploit documents) (`T1566.001`). Upon execution, it drops a highly obfuscated payload into a random `AppData` subdirectory (`T1027`). It establishes persistence by modifying Registry Run keys or creating hidden scheduled tasks (`T1547.001`). The core functionality involves deep process injection (`T1055`), specifically targeting web browsers (`iexplore.exe`, `chrome.exe`, `firefox.exe`). Once injected, it performs 'Web Injects' (`T1185`): when the user visits a targeted banking URL (retrieved from a configuration file downloaded from the C2 server), the trojan dynamically modifies the HTML/JavaScript of the page, presenting fake login forms or transaction authorization prompts directly to the user.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is catastrophic financial fraud and total credential compromise. Host-based IoCs include EDR alerts for 'Suspicious Process Hollowing' or 'API Hooking' targeting major web browsers. Network IoCs include encrypted beaconing traffic to known botnet C2 panels, and the downloading of encrypted configuration files (`.bin` or `.cfg` files containing the targeted bank URLs).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1055",
    "T1547.001",
    "T1185",
    "T1555.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1185",
      "name": "Browser Session Hijacking (Man-in-the-Browser / Web Injects)",
      "tactic": "Collection"
    },
    {
      "id": "T1055",
      "name": "Process Injection (Injecting into browser processes)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1555.003",
      "name": "Credentials from Password Stores: Credentials from Web Browsers",
      "tactic": "Credential Access"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint from the network to sever the C2 connection and prevent the attacker from initiating fraudulent transactions or deploying further modules.",
    "Contact the victim's financial institutions immediately to freeze accounts and alert them to the high probability of a Man-in-the-Browser compromise.",
    "Assume all web credentials stored on or entered into the machine have been stolen, and mandate enterprise-wide password resets.",
    "Capture a live memory image (RAM dump) to extract the decrypted Pwszbot configuration file, which will reveal exactly which banks and URLs the malware was targeting."
  ],
  "what_to_avoid": [
    "Do not rely on standard MFA (like SMS codes) to protect accounts if a banking trojan is suspected, as the attacker is actively intercepting those codes.",
    "Avoid simply running an AV scan and leaving the machine online; banking trojans require a complete wipe and reimage to ensure the deep API hooks are removed."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}