Loader
Zloader
aka DELoader · SILENTNIGHT · Terdot
This family describes the (initially small) loader, which downloads Zeus OpenSSL.
Zloader, also known as DELoader, SILENTNIGHT, Terdot, is a Windows loader.
Background
This family covers the loader (small at first) responsible for downloading Zeus OpenSSL.
Fortinet named this new loader DEloader in June 2016. While it reuses a handful of routines from Zeus 2.0.8.9 (such as the versioning scheme, nrv2b, and binstorage-labels), its key role was fetching a Zeus-like banking trojan (-> Zeus OpenSSL), and it shared its version numbering with the Zeus OpenSSL it retrieved. The earliest samples from May 2016 were tiny at 17920 bytes. visualEncrypt/Decrypt was introduced later, for example in v1.11.0.0 (September 2016) at 27648 bytes. In January 2017, v1.15.0.0 added obfuscation that grew the size to around 80k, at which point the loader came to be called Zloader, also known as Terdot. These developments may tie in with the Moskalvzapoe Distribution Network, which began distributing it around the same time.
Note that IBM X-Force chose to label win.zloader/win.zeus_openssl as "Zeus Sphinx" after referring to it as "a new version of Zeus Sphinx" in their August 2016 post. Malpedia therefore records the alias "Zeus XSphinx" for win.zeus_openssl, with the X denoting IBM X-Force.
Source: Malpedia (Fraunhofer FKIE).