TSPY_ZBOT.SMVP
PWS:Win32/Zbot (Microsoft), Trojan.Zbot (Symantec), W32/Zbot.RUUO!tr (Fortinet), Trojan-Spy.Zbot (Ikarus), Win32/Spy.Zbot.AAU trojan (Eset)
Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)
![](/vinfo/imgFiles/legend.jpg)
Threat Type: Spyware
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It deletes itself after execution.
TECHNICAL DETAILS
802,304 bytes
EXE
Yes
18 Mar 2014
Arrival Details
This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This spyware drops the following copies of itself into the affected system and executes them:
- %Application Data%\{random folder}\{random file name 1}.exe
(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)
It drops the following files:
- %Application Data%\Microsoft\Address Book\{user name}.wab
- %System%\drivers\{random file name 2}.sys
(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %System% is the Windows system folder, which is usually C:\Windows\System32.)
It creates the following folders:
- %Application Data%\{random folder}
- %Application Data%\Microsoft\Address Book
(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)
Autostart Technique
This spyware adds the following registry entries to enable its automatic execution at every system startup:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random file name 1} = "%Application Data%\{random folder}\{random file name 1}.exe"
It registers its dropped component as a system service to ensure its automatic execution at every system startup. It does this by creating the following registry entries:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random file name 2}
DisplayName = "{random file name 1}.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random file name 2}
ImagePath = %System%\drivers\{random file name 2}.sys
It registers its dropped component as a system service to ensure its automatic execution at every system startup. It does this by creating the following registry keys:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random file name 2}
Other System Modifications
This spyware adds the following registry keys:
HKEY_CURRENT_USER\Software\Microsoft\
{random}
HKEY_CURRENT_USER\Software\Microsoft\
WAB
HKEY_CURRENT_USER\Software\Microsoft\
WAB\WAB4
HKEY_CURRENT_USER\Software\Microsoft\
WAB\WAB4\Wab File Name
It adds the following registry entries:
HKEY_CURRENT_USER\Software\Microsoft\
{random}
{random} = "{random}"
HKEY_CURRENT_USER\Software\Microsoft\
WAB\WAB4
OlkContactRefresh = "0"
HKEY_CURRENT_USER\Software\Microsoft\
WAB\WAB4
OlkFolderRefresh = "0"
HKEY_CURRENT_USER\Software\Microsoft\
WAB\WAB4\Wab File Name
(Default) = "%Application Data%\Microsoft\Address Book\{user name}.wab"
It creates the following registry entry(ies) to bypass Windows Firewall:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\GloballyOpenPorts\
List
{random port 1}:UDP = "{random port 1}:UDP:*:Enabled:UDP {random port 1}"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\GloballyOpenPorts\
List
{random port 2}:TCP = "{random port 2}:TCP:*:Enabled:TCP {random port 2}"
Other Details
This spyware deletes itself after execution.
NOTES:
This spyware connects to randomly generated URLs.