TSPY_ZBOT.YUYATJ

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system. As of this writing, the said sites are inaccessible.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This spyware injects codes into the following process(es):

• explorer.exe

Other System Modifications

This spyware adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Test

Download Routine

This spyware accesses the following websites to download files:

• https://{BLOCKED}roleo.xyz/dpr.bin
• https://{BLOCKED}ectos.top/dpr.bin
• https://{BLOCKED}elio.top/dpr.bin

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

As of this writing, the said sites are inaccessible.

Other Details

This spyware does the following:

• Once a binary is successfully downloaded, it will search the process "explorer.exe" in the list of currently running process. It executes the downloaded file by injecting codes in the said running process.
• It also checks the presence of the following registry where it attempts to read data:
  • HKEY_CURRENT_USER\Software\Microsoft\ozavozva
    ciz = {data}