TSPY_ZBOT.EZQD

This spyware attempts to steal information, such as user names and passwords, used when logging into certain banking or finance-related websites.

Arrival Details

This spyware may be downloaded from the following remote sites:

• http://nfruhskhfts.com/bs/sas.exe

Installation

This spyware adds the following folders:

• %Application Data%\{random1}
• %Application Data%\{random2}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It injects itself into the following processes running in the affected system's memory:

• explorer.exe
• taskhost.exe
• taskeng.exe
• Dwm.exe
• wscntfy.exe
• ctfmon.exe
• rdpclip.exe

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{GUID of mount point of %Windows%} = %Application Data%\{random1}\{random}.exe

It drops the following files:

• %Application Data%\{random1}\{random}.exe - copy of itself
• %Application Data%\{random2}\{random} - contains encrypted stolen data

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

Other System Modifications

This spyware adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft
{random} =

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\PhishingFilter
Enabled = 0

HKEY_CURRENT_USER\Software\Microsoft\
InternetExplorer\PhishingFilter
EnabledV8 = 0

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%WINDOWS%\\EXPLORER.EXE = %WINDOWS%\EXPLORER.EXE:*:Enabled:Windows Explorer

Information Theft

This spyware monitors the Internet Explorer (IE) activities of the affected system, specifically the address bar or title bar. It recreates a legitimate website with a spoofed login page if a user visits banking sites with the following strings in the address bar or title bar:

• https://banking.*.de/cgi/*
• https://banking.*.de/portal/portal/*
• https://banking.dkb.de/dkb/-*
• https://banking.postbank.de/app/finanzstatus*
• https://banking.postbank.de/app/finanzstatus.init.do*
• https://banking.postbank.de/app/static/js/script.js
• https://banking.postbank.de/app/tan.historie.*.do*?viewmode=ta*
• https://banking.postbank.de/app/ueberweisung*
• https://banking.postbank.de/app/verwaltung.init.do*
• https://banking.postbank.de/app/wel*
• https://kunde.comdirect.de/ccf/deprecated/cdb/js/jsstatic.js
• https://kunde.comdirect.de/lp/wt/login*
• https://kunde.comdirect.de/tx/brokerage/common/*
• https://meine.deutsche-bank.de/trxm/db/*DisplayFinancialOverview*
• https://meine.deutsche-bank.de/trxm/db/*ManageTAN*
• https://www.commerzbanking.de/P-Portal1/XML/*
• https://www.commerzbanking.de/P-Portal1/XML/ifilportal/js_bb/util.js
• https://www.dab-bank.de*
• https://www.targobank.de/*/banque/situation_financiere.cgi
• https://www.targobank.de/*/online-banking/login.cgi

It accesses the following site to download its configuration file:

• http://{BLOCKED}khfts.com/bs/lusa.bin

It attempts to steal information from the following banks and/or other financial institutions:

• ANZ
• Comdirect
• DAB

Drop Points

Stolen information is uploaded to the following websites:

• http://{BLOCKED}skhfts.com/bs/lvv.php

Other Details

Based on analysis of the codes, it has the following capabilities:

• This malware is also capable of stealing information such as Personal Certificates(MY), Flashplayer data, and Internet session cookies. It also steals FTP credentials for the following FTP applications: flashxp, ghisler, ipswitch, filezilla, ftpfar, winscp, ftpcommander, coreftp, and smartftp.

It does the following:

• It adds a registry key as part of its installation routine.
• It adds registry entries to disable Internet Explorer PhistingFilter.

Variant Information

This spyware has the following MD5 hashes:

• 17fc2ab1c102ba1b6518dafe6614a9e3

It has the following SHA1 hashes:

• 9499057a08710dc6b24f659fde88a06bb3ab0fb6