Zlob

Overview

TrojanDownloader:Win32/Zlob (also known as the Zlob Trojan or Mac DNS Changer) is a historically massive and foundational malware family that peaked in the late 2000s. Zlob is infamous for pioneering the 'Fake Codec' drive-by download lure. It was primarily used to build a massive botnet dedicated to downloading and installing highly aggressive Rogue Security Software (Scareware) and adware onto victim machines.

Understanding the Zlob Trojan
To a victim, a Zlob infection typically began while browsing adult websites or attempting to download pirated movies. The user would click a video link and receive a highly realistic prompt stating, 'You need to download the latest ActiveX Video Codec to view this content.' Clicking 'OK' downloaded the Zlob trojan. For security analysts, Zlob represents the industrialization of the Pay-Per-Install (PPI) scareware ecosystem. It relied entirely on social engineering (`T1204.002`) rather than software exploits.

Execution and the Scareware Pipeline
Upon execution of the fake codec installer, Zlob establishes deep persistence, often dropping randomly named DLLs into the `System32` directory and registering them as Browser Helper Objects (BHOs) or utilizing the `Winlogon\Notify` registry key (`T1547`). Its primary function is a downloader (`T1105`). It silently reaches out to its C2 infrastructure and begins pulling down a barrage of secondary payloads. These payloads were almost exclusively aggressive Rogue Antivirus programs (like SpywareQuake or Microsoft Antispyware 2009) that would flood the user's screen with fake alerts (`T1491`) demanding credit card payments. Advanced variants (like the DNS Changer variant) altered the system's DNS settings (`T1562.001`) to redirect all web traffic through attacker-controlled servers.

Indicators of Compromise & Impact
The impact was total system hijacking by scareware and potential financial fraud. Incident responders would observe massive, chaotic outbound HTTP traffic as Zlob downloaded its payloads. EDR logs would flag the creation of numerous unexpected DLLs in system directories and unauthorized modifications to the `Winlogon` registry keys.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_ZLOB {
    meta:
        description = "Detects Zlob (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "zlob" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Zlob Activity
id: 46ec50bd80291398204bc03d1667a583
status: experimental
description: Detects generic indicators of the zlob malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*zlob*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Boot the infected machine into 'Safe Mode with Networking' to bypass the malware's autostart mechanisms and fake AV blockers.
2. Check and reset the system's DNS settings (IPv4 properties) to ensure traffic is not being routed through malicious servers.
3. Utilize a standalone, reputable malware removal tool to scan the system, specifically targeting the `System32` directory and BHO registry keys.
4. Advise the end-user NOT to enter their credit card information into any of the aggressive pop-up warnings.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not trust the 'Antivirus' software demanding payment; it is the secondary payload dropped by Zlob.
2. Avoid attempting manual removal of Zlob DLLs while the OS is running normally, as they are often injected into `explorer.exe` and cannot be deleted.

References & External Analysis

• Search "zlob" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Bundleloader
• Sinowal
• Infinitetear
• Genericrxby
• 6B47672C

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/zlob.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.