Malware
ZeroEvil
ZeroEvil is a malware that seems to be distributed by an ARSguarded VBS loader.
ZeroEvil is a Windows malware family.
Background
ZeroEvil appears to be delivered through an ARSguarded VBS loader.
It begins by contacting gate.php (version=). If that succeeds, an embedded VBS launches and reaches out to logs_gate.php (plugin=, report=). Only a single embedded VBS has been seen so far: it writes and runs a PowerShell script that extracts every password from the Windows.Security.Credentials.PasswordVault, then captures a screenshot and compiles a list of running processes.
The ZeroEvil binary bundles several DLLs—sqlite3.dll, ze_core.DLL (Mutex), and ze_autorun.DLL (Run-Key).
Source: Malpedia (Fraunhofer FKIE).