TSPY_ZBOT.KVV

This spyware arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be dropped by other malware.

It is injected into all running processes to remain memory resident.

It modifies the Internet Explorer Zone Settings.

However, as of this writing, the said sites are inaccessible. It deletes the initially executed copy of itself.

Arrival Details

This spyware arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be dropped by the following malware:

• an RTF file also detected as TSPY_ZBOT.KVV

Installation

This spyware drops the following copies of itself into the affected system and executes them:

• %Application Data%\Quittung 2014-21-01.exe - dropped by the RTF file detected as TSPY_ZBOT.KVV
• %Application Data%\{random1}\{random}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It drops the following files:

• %Application Data%\{random2}\{random}.{random}
• %Application Data%\Microsoft\Address Book\{OS version}.wab
• %Application Data%\Microsoft\Address Book\{user name}.wab~

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It creates the following folders:

• %Application Data%\{random1}
• %Application Data%\{random2}
• %Application Data%\Microsoft\Address Book

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It is injected into all running processes to remain memory resident.

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random} = "%Application Data%\{random1}\{random}.exe"

Other System Modifications

This spyware adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
{random}

HKEY_CURRENT_USER\Software\Microsoft\
WAB

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%Windows%\explorer.exe = "%Windows%\explorer.exe:*:Enabled:Windows Explorer"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\GloballyOpenPorts\
List
{port}:UDP = "{port}:UDP:Enabled:UDP {port}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\GloballyOpenPorts\
List
{port}:TCP = "{port}:TCP:Enabled:TCP {port}"

Web Browser Home Page and Search Page Modification

This spyware modifies the Internet Explorer Zone Settings.

Information Theft

This spyware accesses the following site to download its configuration file:

• http://{BLOCKED}ski.prfact.ch/sadcxvbv/vdfbffddf.php|file=config2.bin

Stolen Information

This spyware sends the gathered information via HTTP POST to the following URL:

• http://{BLOCKED}ec948fa2bc.com/53085816/0d5e28f7.php

Other Details

However, as of this writing, the said sites are inaccessible.

It deletes the initially executed copy of itself

NOTES:

This malware is an embedded .EXE file to a .RTF file that is disguised as an image:

The users are tricked into double-clicking the fake image above and as a result, the copy of TSPY_ZBOT.KVV(.EXE file) is dropped on the system.

The configuration file may contain URLs where it downloads an updated copy of itself and sends its gathered information. It may also contain URLs of its target online banking and finance-related sites from where it steals information.

It may also gather the following information from the affected system:

• Data on Cookie files (URLs)
• Email-related information such as account names, email addresses, passwords, server data, and server port
• Email information stored in the user’s Windows Address Book (WAB) file
• FTP credentials
• Online banking credentials
• Flashplayer data
• Personal digital cerificates