ZLOB Trojan

Some of the Username &Password (username: password format) combination used by the Trojan is following:

• !root:
• 11111:x-admin
• 1234:1234
• 1500:and 2000 Series
• 1502:1502
• :1064
• :1234
• :12345
• :1234admin
• :3477
• :3ascotel
• :4getme2
• :9999
• :BRIDGE
• :Cisco
• :Intel
• :PASSWORD
• :SMDR
• :SUPER
• :Symbol
• :TANDBERG
• :TENmanUFactOryPOWER
• :Telecom
• :_Cisco
• :access
• :admin
• :administrator
• :ascend
• :atc123
• :cisco
• :connect
• :default
• :enter
• :epicrouter
• :help
• :hs7mwxkk
• :letmein
• :medion
• :nokia
• :password
• :pento
• :public
• :secret
• :sitecom
• :smcadmin
• :speedxess
• :sysadm
• : system
• ADMINISTRATOR:ADMINISTRATOR
• ADMN:admn
• ADSL:expert03
• ADVMAIL:HP
• ADVMAIL:HPOFFICE DATA
• Admin:
• Admin:123456
• Admin:admin
• Administrator:
• Administrator:3ware
• Administrator:admin
• Administrator:changeme
• Administrator:ganteng
• Administrator:password
• Administrator:pilou
• Administrator:smcadmin
• Any:12345
• CISCO15:otbu+1
• CSG:SESAME
• Cisco:Cisco
• FIELD:HPONLY
• FIELD:HPP187 SYS
• FIELD:HPWORD PUB
• FIELD:LOTUS
• FIELD:MANAGER
• FIELD:MGR
• FIELD:SERVICE
• FIELD:SUPPORT
• Factory:56789
• GEN1:gen1
• GEN2:gen2
• Gearguy:Geardog
• HELLO:FIELD.SUPPORT
• HELLO:MANAGER.SYS
• HELLO:MGR.SYS
• HELLO:OP.OPERATOR
• HTTP:HTTP
• IntraStack:Asante
• IntraSwitch:Asante
• MAIL:HPOFFICE
• MAIL:MAIL
• MAIL:MPE
• MAIL:REMOTE
• MAIL:TELESUP
• MANAGER:COGNOS
• NAGER:HPOFFICE
• MANAGER:ITF3000
• MANAGER:SECURITY
• MANAGER:SYS
• MANAGER:TCH
• MANAGER:TELESUP
• MDaemon:MServer
• MGR:CAROLIAN
• MGR:CCC
• MGR:CNAS
• MGR:COGNOS
• MGR:CONV
• MGR:HPDESK
• MGR:HPOFFICE
• MGR:HPONLY
• MGR:HPP187
• MGR:HPP189
• MGR:HPP196
• MGR:INTX3
• MGR:ITF3000
• MGR:NETBASE
• MGR:REGO
• MGR:RJE
• MGR:ROBELLE
• MGR:SECURITY
• MGR:SYS
• MGR:TELESUP
• MGR:VESOFT
• MGR:WORD
• MGR:XLSERVER
• MICRO:RSX
• Manager:
• Manager:friend
• NAU:NAU
• NICONEX:NICONEX
• OPERATOR:COGNOS
• OPERATOR:DISC
• OPERATOR:SUPPORT
• OPERATOR:SYS
• OPERATOR:SYSTEM
• PCUSER:SYS
• PRODDTA:PRODDTA
• Polycom:456
• Polycom:SpIp
• RMUser1:password
• RSBCMON:SYS
• Root:
• SPOOLMAN:HPOFFICE
• SSA:SSA
• SYSADM:sysadm
• SYSDBA:masterkey
• Service:5678
• TMAR#HWMT8007079:
• USERID:PASSW0RD
• User:
• User:Password
• WP:HPOFFICE
• aaa:often blank
• admin2:changeme
• admin:
• admin:
• admin:0
• admin:1111
• admin:123
• admin:1234
• admin:12345
• admin:123456
• admin:123456
• admin:1234admin
• admin:2222
• admin:22222
• admin:Ascend
• admin:NetCache
• admin:NetSurvibox
• admin:OCS
• admin:OkiLAN
• admin:P@55w0rd!
• admin:Password
• admin:Protector
• admin:Sharp
• admin:access
• admin:admin
• admin:admin
• admin:admin123
• admin:administrator
• admin:adslolitec
• admin:adslroot
• admin:articon
• admin:asante
• admin:asd
• admin:atlantis
• admin:barricade
• admin:bintec
• admin:changeme
• admin:comcomcom
• admin:default
• admin:draadloos
• admin:epicrouter
• admin:extendnet
• admin:hagpolm1
• admin:hello
• admin:hp.com
• admin:imss7.0
• admin:ironport
• admin:isee
• admin:leviton
• admin:linga
• admin:michelangelo
• admin:microbusiness
• admin:motorola
• admin:mu
• admin:my_DEMARC
• admin:netadmin
• admin:noway
• admin:operator
• admin:password
• admin:password
• admin:passwort
• admin:pfsense
• admin:rmnetlm
• admin:secure
• admin:setup
• admin:smallbusiness
• admin:smcadmin
• admin:switch
• admin:symbol
• admin:synnet
• admin:sysAdmin
• admin:w2402
• admin:x-admin
• administrator:
• adminstat:OCS
• adminstrator:changeme
• adminttd:adminttd
• adminuser:OCS
• adminview:OCS
• apc:apc
• cablecom:router
• cac_admin:cacadmin
• ccrusr:ccrusr
• cellit:cellit
• cisco:
• citel:password
• comcast:
• comcast:1234
• craft:
• cusadmin:highspeed
• customer:none
• dadmin:dadmin01
• davox:davox
• deskalt:password
• deskman:changeme
• desknorm:password
• deskres:password
• device:device
• diag:danger
• disttech:4tas
• e250:e250changeme
• e500:e500changeme
• guest:
• guest:guest
• helpdesk:OCS
• hsa:hsadb
• images:images
• install:secret
• installer:installer
• intel:intel
• intermec:intermec
• isp:isp
• jagadmin:
• l2:l2
• l3:l3
• login:access
• login:admin
• m1122:m1122
• maint:maint
• maint:ntacdmax
• manage:!manage
• manager:admin
• manager:change_on_install
• manager:friend
• manager:manager
• manuf:xxyyzz
• mediator:mediator
• mlusr:mlusr
• monitor:monitor
• mso:w0rkplac3rul3s
• naadmin:naadmin
• netadmin:nimdaten
• netman:
• netrangr:attack
• netscreen:netscreen
• none:0
• none:admin
• operator:
• operator:$chwarzepumpe
• operator:1234
• operator:operator
• patrol:patrol
• piranha:piranha
• piranha:q
• public:
• public:public
• radware:radware
• readonly:lucenttech2
• readwrite:lucenttech1
• replicator:replicator
• ro:ro
• root:
• root:0P3N
• root:1234
• root:12345
• root:3ep5w2u
• root:Cisco
• root:Mau'dib
• root:admin
• root:admin_1
• root:ascend
• root:attack
• root:blender
• root:calvin
• root:changeme
• root:davox
• root:default
• root:fivranne
• root:iDirect
• root:pass
• root:password
• root:root
• root:tslinux
• rw:rw
• rwa:rwa
• scmadmin:scmchangeme
• scout:scout
• security:security
• service:smile
• setup:changeme
• setup:setup
• smc:smcadmin
• storwatch:specialist
• stratacom:stratauser
• super.super:
• super.super:master
• super:5777364
• super:super
• superadmin:secret
• superman:21241036
• superman:talent
• superuser:admin
• supervisor:
• supervisor:PlsChgMe
• supervisor:supervisor
• support:h179350
• support:support
• sys:uplink
• sysadmin:PASS
• sysadmin:password
• system:password
• system:sys
• teacher:password
• telecom:telecom
• tellabs:tellabs#1
• temp1:password
• tiara:tiaranet
• tiger:tiger123
• topicalt:password
• topicnorm:password
• topicres:password
• user:
• user:password
• user:tivonpw
• user:user
• vcr:NetVCR
• vt100:public
• webadmin:1234
• webadmin:webadmin
• websecadm:changeme
• wlse:wlsedb
• wradmin:trancell
• xd:xd
• zxc:cascade