Skip to content
MalwareWiki

Banking trojan

xzbot

aka xzorcist

A backdoor brought into version 5.6.0 and 5.6.1 of compression library/tool xz/liblzma, which was intended to enable access via (Open)SSH on affected servers.

xzbot, also known as xzorcist, is a Shell banking trojan.

Background

A backdoor planted in releases 5.6.0 and 5.6.1 of the xz/liblzma compression library and tool, designed to grant attackers access to compromised servers through (Open)SSH.

Source: Malpedia (Fraunhofer FKIE).