TSPY_ZBOT.HXQB

This spyware attempts to steal information, such as user names and passwords, used when logging into certain banking or finance-related websites.

Arrival Details

This spyware may be downloaded from the following remote sites:

• http://{BLOCKED}chinesearch.com/flashmedia.exe

Installation

This spyware adds the following folders:

• %Application Data%\{random1}
• %Application Data%\{random2}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It injects itself into the following processes running in the affected system's memory:

• explorer.exe
• taskhost.exe
• taskeng.exe
• Dwm.exe
• wscntfy.exe
• ctfmon.exe
• rdpclip.exe

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{GUID of mount point of %Windows%} = %Application Data%\{random1}\{random}.exe

It drops the following files:

• %Application Data%\{random1}\{random}.exe - copy of itself
• %Application Data%\{random2}\{random} - contains encrypted stolen data

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

Other System Modifications

This spyware adds the following registry keys as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft
{random} =

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%WINDOWS%\\EXPLORER.EXE = %WINDOWS%\EXPLORER.EXE:*:Enabled:Windows Explorer

Information Theft

This spyware monitors the Internet Explorer (IE) activities of the affected system, specifically the address bar or title bar. It recreates a legitimate website with a spoofed login page if a user visits banking sites with the following strings in the address bar or title bar:

• *.ebay.com/*eBayISAPI.dll?*
• */atl.osmp.ru/*
• */login.osmp.ru/*
• */my.ebay.com/*CurrentPage=MyeBayPersonalInfo*
• *injtoken*
• *signOnOption=*
• *userid=*
• *vtbCompanyId*
• http://fbtonline.com/home/
• http://unfcu.org/
• http://www.ncsecu.org/*
• http://www.unfcu.org/
• http://www.wellsfargo.com/error
• https://*.ebanking-services.com/nubi/StrongAuth/SignInContinue_Register.aspx
• https://*.web-cashplus.com/Cashplus/
• https://*/IBWS/checkUser.do
• https://*treasury.pncbank.com/*/login.ht
• https://access.jpmorgan.com/appmanager/jpmalogonportal/jpmalogonhome*
• https://alltimetreasury.pacificcapitalbank.com/TekPortfolio/servlet/TB_UI_Controller*
• https://banking.calbanktrust.com/iLogin.jsp
• https://bankoffortbendonline.com/onlineserv/CM*
• https://bnycash.bankofny.com/
• https://bob.sovereignbank.com/wcmfd/wcmpw/CustomerLogin
• https://boh.webcashmgmt.com/phcp/servlet/LoginServlet
• https://business-eb.ibanking-services.com/K1/*
• https://business-eb.ibanking-services.com/K1/sb_login.jsp*
• https://businessaccess.citibank.citigroup.com/cbusol/signon.do
• https://businessonline.huntington.com/BOLHome/BusinessOnlineLogin.aspx
• https://businessonline.tdbank.com/CorporateBankingWeb/Core/Login.aspx*
• https://businessonlinebanking.ebanking-services.com/Nubi/signin.aspx
• https://cashman.arvest.com/cashman*Auth.asp
• https://cashmanagement.firstambank.com/iBank/cmserver/loginforwardtourl.cfm
• https://cashmanagement.firstambank.com/iBank/cmserver/verify.cfm
• https://cashmgt.firsttennessee.biz/WebID/IISWebAgentIF.dll
• https://cashmgt.firsttennessee.biz/cb/servlet/cb/login.jsp
• https://cbs.firstcitizens.com/cb/servlet/cb/loginfcbnc.jsp
• https://chaseonline.chase.com/MyAccounts.aspx
• https://citizensbank.ebanking-services.com/Nubi/signin.aspx
• https://cm.firstbankpr.com/cashplus/
• https://cm.netteller.com/login*/Authentication/Views/LoginCM.aspx
• https://commerceconnections.commercebank.com/ibank/cmserver/welcome/default/verify.cfm
• https://commercial.wachovia.com/Online/Financial/Business/Service*
• https://ctreporter.coletaylor.com/bbw/cmserver/appserver_login_validate.cfm*
• https://ctreporter.coletaylor.com/bbw/cmserver/welcome/default/verify.cfm
• https://e-access.compassbank.com/bbw/cmserver/welcome/default/verify.cfm
• https://ecash.fsbnm.com/cashman//Auth.asp
• https://ecash.fsbnm.com/cashman/Default.aspx
• https://ecash.fsbnm.com/out.html
• https://express.53.com/express/logon.action1
• https://ffce.webcashmgmt.com/wcmfd/wcmpw/CustomerLogin
• https://goldleafach.com/ach/Login.aspx*
• https://ibank.scnb.com/inets/Login.cfm
• https://imanage.ebanking-services.com/Nubi/Signin.aspx
• https://internetbanking.firsttennessee.biz/*
• https://itreasury.regions.com/phcp/servlet/CustomerLoginServlet
• https://ktt.key.com/ktt/cmd/logon
• https://lakecitybank.webcashmgmt.com/wcmfd/wcmpw/CustomerLogin
• https://mibusinessonlinebanking.ebanking-services.com/nubi/signin.aspx
• https://myib.firstmerchants.com/fi3039a_auth/sbuser/slogon
• https://netconnect.bokf.com/bbw/cmserver/welcome/default/verify.cfm
• https://onb.webcashmgmt.com/wcmfd/wcmpw/CustomerLogin
• https://online.citibank.com/*
• https://online.wamu.com/Servicing/Servicing.aspx?targetPage=AccountSummary
• https://online.wellsfargo.com/das/cgi-bin/session.cgi*
• https://onlineaccess.ncsecu.org/login.aspx
• https://onlinebanking.nationalcity.com/OLB/secure/AccountList.aspx
• https://onlineeast#.bankofamerica.com/cgi-bin/ias/*/GotoWelcome
• https://onlinetreasurymanager.suntrust.com/ibswebsuntrust/cmserver/welcome/default/verify.cfm
• https://passport.texascapitalbank.com/BankNow.aspx
• https://passport.texascapitalbank.com/Default.aspx
• https://passport.texascapitalbank.com/WebID/IISWebAgentIF.dll
• https://privatebk.ebanking-services.com/Nubi/signin.aspx
• https://secure.fundsxpress.com/piles/fxweb.pile/custom_login?template=login&no_top_url=1&iid=ABMWI
• https://secure.ingdirect.com/myaccount/INGDirect.html
• https://secure.ingdirect.com/myaccount/InitialINGDirect.html*
• https://securentrycorp.calbanktrust.com/Authentication/zbf/index?appId=PORTAL&domainId=cbt
• https://securentrycorp.calbanktrust.com/Authentication/zbf/k/*
• https://securentrycorp.calbanktrust.com/Enrollment/zbf/k/1
• https://singlepoint.usbank.com/*
• https://top.capitalonebank.com/pub/html/login.html
• https://trading.scottrade.com/home/default.aspx
• https://treas-mgt.frostbank.com/rdp/cgi-bin/*
• https://treasury.wamu.com/ibswamu/cmserver/login_validate.cfm*
• https://treasury.wamu.com/ibswamu/cmserver/welcome/default/verify.cfm
• https://treasurydirect.tdbank.com/ibsweb/cmserver/welcome/default/verify.cfm
• https://usgateway1.rbs.com/usgateway/cb/gpsmoneymanager.jsp
• https://usgateway2.rbs.com/usgateway/cb/gpsmoneymanager.jsp
• https://web.da-us.citibank.com/*BS_Id=MemberHomepage*
• https://web6.secureinternetbank.com/ebc_ebc1961/ebc1961.asp?wci=process&wce=request&rid=3000&rtn=071925046&rt=071925046
• https://webexpress.tdbanknorth.com/wcmfd/wcmpw/CustomerLogin
• https://wellsoffice.wellsfargo.com/portal/signon/index.jsp
• https://ws2.bankbyweb.net/EBC_EBC1961/*
• https://wtb.ebanking-services.com/nubi/signin.aspx
• https://www#.citizensbankonline.com/*/index-wait.jsp
• https://www#.usbank.com/internetBanking/LoginRouter
• https://www.53.com/servlet/efsonline/index.html*
• https://www.53.com/wps/portal/cblogin
• https://www.americansavingsnj2.com/onlineserv/CM/
• https://www.bankoffortbendonline.com/onlineserv/CM*
• https://www.bankunitedbusinessexpress.blilk.com/Core/Authentication/MFAUsername.aspx
• https://www.bbvacompass.com/contact/
• https://www.businesse-cashmanager.web-access.com/natpenn/cgi-bin/welcome.cgi
• https://www.businessonlineaccess.web-cashplus.com/Cashplus/1
• https://www.cashanalyzer.com/cgi-bin/carsa#clnt.dll/CA%20-%20Main1/ND000_
• https://www.columbiabankonline.com/onlineserv/CM/
• https://www.columbiabankonline.com/onlineserv/CM/index.cgi
• https://www.directline4biz.com/bbw/cmserver/login_validate.cfm*
• https://www.directline4biz.com/challenge100.cfm
• https://www.easterntreasuryconnect.com/bbw/cmserver/appserver_login_validate.cfm
• https://www.easterntreasuryconnect.com/bbw/cmserver/welcome/default/verify.cfm
• https://www.eastwestbankhb.com/onlineserv/CM/*
• https://www.ecathay.com/onlineserv/CM/
• https://www.ffsbkyonline.com/*
• https://www.fiservdmecorp1.net/EBC_EBC1961/EBC1961.asp?*
• https://www.fiservla10.com/EBC_EBC1961/EBC1961.ASP?*=Passmark*
• https://www.fiservla10.com/EBC_EBC1961/EBC1961.ASP?*=Request*
• https://www.frostbank.com/sitemap/Pages/default.aspx
• https://www.gruposantander.es/*
• https://www.independentcm.com/onlineserv/CM/
• https://www.manufacturers.web-access.com/wa/cgi-bin/welcome.cgi
• https://www.mybusinessbank.co.uk/cs70_banking/logon/slogon
• https://www.nashvillecitizensbank.com/olbb/Login2FA.asp
• https://www.nationalcity.com/consultnc/
• https://www.paypal.com/*/webscr?cmd=_account
• https://www.paypal.com/*/webscr?cmd=_login-done*
• https://www.securechemicalbankmi.com/onlineserv/CM/
• https://www.skagitonlinebanking.com/onlineserv/CM/
• https://www.sterlingcorporatenetbanking.com/bbw/cmserver/login_validate.cfm*
• https://www.sterlingwires.com/
• https://www.sunnb.blilk.com/Core/Authentication/MFAUsername.aspx
• https://www.suntrust.com/portal/server.pt*parentname=Login*
• https://www.svbconnect.com/*
• https://www.svbconnect.com/security/integratedLoginAuth.do
• https://www.svbconnect.com/useraccess/Login.jsp
• https://www.us.hsbc.com/*
• https://www.us.hsbc.com/*business.online*
• https://www.whitneybank.web-access.com/whitney/cgi-bin/welcome.cgi
• https://www2.alerusfinancial.com/cashman//Auth.asp
• https://www2.alerusfinancial.com/cashman/default.Aspx
• https://www2.alerusfinancial.com/out.html
• https://www8.comerica.com/cma/portal/mybusinessconnect
• https://www8.comerica.com/out.html

It accesses the following site to download its configuration file:

• http://{BLOCKED}ech.net/cfg1.bin
• http://{BLOCKED}chinesearch.com/params.bin

It attempts to steal information from the following banks and/or other financial institutions:

• Bank of America
• Capital One
• Chase
• Citibank
• Citizens
• Citizens Bank
• Compass Bank
• Ebay
• Fifth Third
• First American Bank
• HSBC
• Money Manager
• National City
• OSPM
• PNC
• PayPal
• Santander
• Suntrust
• US Bank
• Wachovia
• Washington Mutual
• Wells Fargo
• iTreasury

Drop Points

Stolen information is uploaded to the following websites:

• http://{BLOCKED}chinesearch.com/flopen.php

Other Details

This spyware does the following:

• It adds the following registry entries to disable Internet Explorer:
  HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter Enabled =0
  HKEY_CURRENT_USER\Software\Microsoft\InternetExplorer\PhishingFilter EnabledV8 =0
• Steals the following information:
  Personal Certificates (MY)
  FTP credentials for the following FTP applications:
  flashxp
  ghisler
  ipswitch
  filezilla
  ftpfar
  winscp
  ftpcommander
  coreftp
  smartftp
  Flashplayer data
  Internet session cookies

Variant Information

This spyware has the following MD5 hashes:

• 2d2f0c7af61867cd84f2e419a62cef16

It has the following SHA1 hashes:

• e734bb114c2f47dc900d3a5a526db94f0b752ba0