TSPY_ZBOT.NQK

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It modifies the Internet Explorer Zone Settings.

It retrieves specific information from the affected system.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This spyware drops the following files:

• %Application Data%\{random folder 2}\random file name 2}.{random extension name 1} - contains encrypted stolen data
• %Application Data%\ie_util.exe - also detected as TSPY_ZBOT.NQK
• %Application Data%\{random folder 3}\random file name 3}.{random extension name 2} - contains encrypted stolen data

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It drops the following copies of itself into the affected system:

• %Application Data%\{random folder 1}\{random file name 1}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It injects itself into the following processes running in the affected system's memory:

• explorer.exe
• taskhost.exe
• taskeng.exe
• Dwm.exe
• wscntfy.exe
• ctfmon.exe
• rdpclip.exe

It creates the following folders:

• %Application Data%\{random folder 1}
• %Application Data%\{random folder 2}
• %Application Data%\{random folder 3}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• {Random GUID} - multiple instances
• FOCTRLM
• FOIDCTRL{Process ID}

It terminates the execution of the copy it initially executed and executes the copy it drops instead.

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random} = "%Application Data%\{random folder 1}\{random file name 1}.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
IExplorer Util = "%Application Data%\ie_util.exe"

Other System Modifications

This spyware adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
{random}

HKEY_CURRENT_USER\Software\Microsoft\
WAB

It adds the following registry entries:

HKEY_CURRENT_USER\Microsoft\{random}
{random characters 1} = {random values}

HKEY_CURRENT_USER\Microsoft\{random}
{random characters 2} = {random values}

HKEY_CURRENT_USER\Microsoft\{random}
{random characters 3} = {random values}

It also creates the following registry entry(ies) as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Privacy
CleanCookies = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Privacy
CleanBrowsingHistoryOnExit = "0"

Web Browser Home Page and Search Page Modification

This spyware modifies the Internet Explorer Zone Settings.

Download Routine

This spyware connects to the following website(s) to download and execute a malicious file:

• http://{BLOCKED}houghmid.su/nsa/file.php

It saves the files it downloads using the following names:

• %User Temp%\tmp{random string}\543.exe - updated copy of itself

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Information Theft

This spyware accesses the following site to download its configuration file:

• http://{BLOCKED}houghmid.su/nsa/file.php|file=zih.set
• http://{BLOCKED}cumentat.su/nsa/file.php|file=zih.set

It retrieves the following information from the affected system:

• FTP credentials
• Internet session cookies
• Flash player data
• Personal certificates

Stolen Information

This spyware sends the gathered information via HTTP POST to the following URL:

• http://{BLOCKED}centerpi.su/myz/olsa.php

Other Details

This spyware connects to the following URL(s) to check for an Internet connection:

• www.google.com