Short bio Spyware.Zbot is Malwarebytes’ detection name for a family of spyware that specializes in stealing confidential information from affected systems, especially banking details.
Where does the Zbot Trojan copy itself?
The Zbot trojan also copies itself to %windir%\\system32 tos.exe (or in some variants.\\oembios.exe). A random amount of junk data is appended to the copy in an attempt to make its detection more difficult.
What is the Goz Botnet used for?
The GOZ botnet was especially noted for distributing banking trojans and ransomware, and being used to commit electronic monetary theft. In 2014, the botnet was the target of a major multinational takedown spearheaded by the United States Federal Bureau of Investigation (FBI).
