TSPY_ZBOT.NTW

This malware is reported to be involved with a malicious campaign concerning the 2012 US Presidential Election. Users affected by this malware may find their online banking credentials stolen.

To get a one-glance comprehensive view of the behavior of this Spyware, refer to the Threat Diagram shown below.

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It is injected into all running processes to remain memory resident.

It modifies the Internet Explorer Zone Settings.

As of this writing, the said sites are inaccessible.

It deletes the initially executed copy of itself.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This spyware drops the following copies of itself into the affected system:

• %User Profile%\Application Data\{random1}\{random}.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It drops the following files:

• %User Profile%\Application Data\Microsoft\Address Book\winxp.wab

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It creates the following folders:

• %User Profile%\Application Data\{random1}
• %User Profile%\Application Data\Microsoft\Address Book

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It is injected into all running processes to remain memory resident.

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random CLSID} = "%User Profile%\Application Data\{random1}\{random}.exe"

Other System Modifications

This spyware adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
{random}

HKEY_CURRENT_USER\Software\Microsoft\
WAB

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%Windows%\explorer.exe = "%Windows%\explorer.exe:*:Enabled:Windows Explorer"

Web Browser Home Page and Search Page Modification

This spyware modifies the Internet Explorer Zone Settings.

Download Routine

This spyware connects to the following URL(s) to download its configuration file:

• http://{pseudorandom alpha characters}.biz
• http://{pseudorandom alpha characters}.org
• http://{pseudorandom alpha characters}.info
• http://{pseudorandom alpha characters}.net
• http://{pseudorandom alpha characters}.ru
• http://{pseudorandom alpha characters}.com

As of this writing, the said sites are inaccessible.

Other Details

This spyware connects to the following URL(s) to check for an Internet connection:

• http://www.google.com/
• http://www.bing.com/

It deletes the initially executed copy of itself

NOTES:

The URL where it connects to is randomly generated using a randomizing function, which is computed based on the system's current date. The download file is the configuration file that contains the list of sites to be monitored.

The configuration file may contain URLs where it downloads an updated copy of itself and where it sends its gathered information. It may also contain URLs of its target online banking and finance-related sites from where it steals the information.