Zeroaccess

Overview

Trojan:Win32/ZeroAccess (also known as Sirefef or max++) was one of the largest and most sophisticated botnets in history. At its peak, it infected millions of machines globally, utilizing a devastatingly effective combination of a kernel-mode rootkit for stealth and a decentralized Peer-to-Peer (P2P) architecture for unstoppable Command and Control (C2). Its primary monetization methods were massive click fraud and Bitcoin mining.

Understanding ZeroAccess
To the victim, a ZeroAccess infection was often silent, save for increased CPU usage (from mining) or a slow internet connection. For security analysts, ZeroAccess was a nightmare. It did not rely on centralized C2 servers that law enforcement could seize. Instead, every infected node communicated with other nodes in a massive P2P swarm. Furthermore, its rootkit components buried the malware so deeply in the operating system that standard antivirus could not see the files or registry keys.

Execution, Rootkits, and P2P Architecture
ZeroAccess was distributed via exploit kits (like Blackhole) and affiliate pay-per-install networks (`T1189`). Upon execution, the installer immediately deployed a complex kernel-mode rootkit (`T1014`). It hijacked the `afd.sys` driver or overwrote critical system files to load its driver at boot. The rootkit hooked SSDT (System Service Descriptor Table) APIs to hide its files, folders, and network connections. For C2, ZeroAccess used a custom P2P protocol over UDP (`T1090.001`). Infected nodes would exchange lists of other peers, ensuring the botnet could always receive new payloads (like updated click-fraud modules or miners) even if major portions of the network were taken offline.

Indicators of Compromise & Impact
The impact was total system compromise and massive bandwidth consumption. Because the rootkit hid the files, traditional disk scans were useless. Network analysts had to look for the distinctive UDP P2P traffic. EDR platforms were required to detect the kernel-level API hooking. If ZeroAccess was detected, the only truly safe remediation was a complete wipe and reinstall of the operating system.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_ZEROACCESS {
    meta:
        description = "Detects Zeroaccess (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "zeroaccess" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Zeroaccess Activity
id: b62138f11d0b844103cd04cdd5e8453d
status: experimental
description: Detects generic indicators of the zeroaccess malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*zeroaccess*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Instantly isolate the endpoint from the network to sever its connection to the ZeroAccess P2P swarm and halt click fraud/mining activities.
2. Due to the advanced kernel-mode rootkit, live analysis is highly unreliable. Capture a memory dump for forensic analysis if necessary.
3. Do not attempt manual removal; the rootkit actively defends its files and registry keys, and attempting to delete them can cause a Blue Screen of Death (BSOD).
4. Perform a bare-metal wipe and complete reinstallation of the Windows Operating System. This is the only guaranteed way to eradicate the rootkit.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not trust the output of standard administrative tools (Task Manager, Regedit, Explorer) on a ZeroAccess infected machine; the rootkit lies to them.
2. Avoid relying on standard AV scans for remediation; they will often fail to see or remove the rootkit drivers.

References & External Analysis

• Search "zeroaccess" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Virledi
• Cliptoshuffler
• Picsys
• Zlob
• Trickster

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/zeroaccess.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.