Netskope Threat Labs

ZBotDldr

ATP Sandbox Adv. HeuristicsAV

ZBotDldr is a VBA macro-based downloader associated with the Zeus banking trojan family that delivers additional malware payloads through malicious Office documents.

First seen
May 2022
Last seen
September 2026
Alert Name
GT:VB.Macros.ZBotDldr.1.04A807E1
GT:VB.Macros.ZBotDldr.1.04A807E1:87A9D
GT:VB.Macros.ZBotDldr.1.056E63CC
GT:VB.Macros.ZBotDldr.1.056E63CC:2B12E
GT:VB.Macros.ZBotDldr.1.211144EE
GT:VB.Macros.ZBotDldr.1.211144EE:47B58
GT:VB.Macros.ZBotDldr.1.2D99E4E3
GT:VB.Macros.ZBotDldr.1.2D99E4E3:410F6
GT:VB.Macros.ZBotDldr.1.32297215
GT:VB.Macros.ZBotDldr.1.33D310AE