Pwszbot

Overview

Trojan:Win32/Pwszbot (a blend of Password Stealer and Zbot/Zeus functionalities) is a highly sophisticated, modular banking trojan and information stealer. It is designed to act as a persistent botnet agent, silently harvesting a massive variety of sensitive data, intercepting web sessions, and granting remote attackers persistent access to the compromised machine. It shares significant code similarities and operational tactics with the infamous Zeus banking trojan.

Understanding Pwszbot (Banking Trojans)
To an end-user, a Pwszbot infection is completely invisible; they can use their computer and browse the internet normally. For a financial institution, it represents a critical threat capable of defeating standard anti-fraud measures. Because it acts as a 'Man-in-the-Browser', it can alter what the user sees on their screen during a banking session, intercepting two-factor authentication codes and manipulating transactions in real-time.

Execution and Credential Harvesting Mechanics
Pwszbot is typically distributed via sophisticated spear-phishing campaigns (often using macros or exploit documents) (`T1566.001`). Upon execution, it drops a highly obfuscated payload into a random `AppData` subdirectory (`T1027`). It establishes persistence by modifying Registry Run keys or creating hidden scheduled tasks (`T1547.001`). The core functionality involves deep process injection (`T1055`), specifically targeting web browsers (`iexplore.exe`, `chrome.exe`, `firefox.exe`). Once injected, it performs 'Web Injects' (`T1185`): when the user visits a targeted banking URL (retrieved from a configuration file downloaded from the C2 server), the trojan dynamically modifies the HTML/JavaScript of the page, presenting fake login forms or transaction authorization prompts directly to the user.

Indicators of Compromise & Impact
The impact is catastrophic financial fraud and total credential compromise. Host-based IoCs include EDR alerts for 'Suspicious Process Hollowing' or 'API Hooking' targeting major web browsers. Network IoCs include encrypted beaconing traffic to known botnet C2 panels, and the downloading of encrypted configuration files (`.bin` or `.cfg` files containing the targeted bank URLs).

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1185: Enforce strong MFA and use browser isolation or hardened browsers for sensitive financial or administrative portals to defeat session hijacking.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_PWSZBOT_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pwszbot"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "pwszbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Pwszbot (Trojan) Execution & Triage
id: ba387193-dd79-54e8-b10b-bfd2b04bf6ea
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Pwszbot malware family. Detects suspicious execution from temporary user
  directories with hidden window flags and background transfer utilities.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/pwszbot
- https://malware-families-catalog.systemhelpdesk.com/defensive/downloader-dropper-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.trojan
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1055
- attack.t1547_001
- attack.t1185
- attack.t1555_003
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
    CommandLine|contains:
    - AppData\Local\Temp
    - -WindowStyle Hidden
    - /e:jscript
    - bitsadmin /transfer
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: medium

rule MALWARE_WIN_PWSZBOT_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pwszbot tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "pwszbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate the endpoint from the network to sever the C2 connection and prevent the attacker from initiating fraudulent transactions or deploying further modules.
2. Contact the victim's financial institutions immediately to freeze accounts and alert them to the high probability of a Man-in-the-Browser compromise.
3. Assume all web credentials stored on or entered into the machine have been stolen, and mandate enterprise-wide password resets.
4. Capture a live memory image (RAM dump) to extract the decrypted Pwszbot configuration file, which will reveal exactly which banks and URLs the malware was targeting.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not rely on standard MFA (like SMS codes) to protect accounts if a banking trojan is suspected, as the attacker is actively intercepting those codes.
2. Avoid simply running an AV scan and leaving the machine online; banking trojans require a complete wipe and reimage to ensure the deep API hooks are removed.

References & External Analysis

• Search "pwszbot" on VirusTotal (External Analysis)
• Search "pwszbot" on Any.Run (Sandbox Sandbox)
• Search "pwszbot" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Trojan)

Explore other documented threats in the same operational category:

• Infinitetear
• Rvrat
• Bototer
• Genericrxgh
• Wfpdisabler
• Delfidelfi
• Bindjpg
• Lmkfrhivlcfba

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/pwszbot.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.