TSPY_ZBOT.YZR

February 15, 2017

Analysis by: Miguel Carlo Ang

ALIASES:

Trojan.Spy.Zeus.C (B)(Emsisoft);TrojWare.Win32.Spy.Zbot.ABW(Comodo);Trojan.Spy.Zeus.C(BitDefender)

PLATFORM:

Windows

OVERALL RISK RATING:

DAMAGE POTENTIAL:

DISTRIBUTION POTENTIAL:

REPORTED INFECTION:

INFORMATION EXPOSURE:

Threat Type: Spyware
Destructiveness: No
Encrypted:
In the wild: Yes

OVERVIEW

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes the initially executed copy of itself.

TECHNICAL DETAILS

File Size:

339,968 bytes

File Type:

EXE

Memory Resident:

Yes

Initial Samples Received Date:

13 Apr 2015

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This spyware drops the following files:

%Application Data%\{random folder name3}\{random file name3}.{random extension}
%Application Data%\Microsoft\Address Book\{Username}.wab
%Application Data%\Microsoft\Address Book\{Username}.wab~

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following copies of itself into the affected system:

%Application Data%\{random folder name1}\{random file name1}.exe
%Application Data%\{random name2}\{random name2}.exe

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random name2} = ""%Application Data%\{random name2}\{random name2}.exe""

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random key} = ""%Application Data%\{random folder name1}\{random file name1}.exe""

Other System Modifications

This spyware adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Account Manager\Accounts

HKEY_CURRENT_USER\Software\Microsoft\
Internet Account Manager\Accounts\Active Directory GC

HKEY_CURRENT_USER\Software\Microsoft\
Internet Account Manager\Accounts\Bigfoot

HKEY_CURRENT_USER\Software\Microsoft\
Internet Account Manager\Accounts\VeriSign

HKEY_CURRENT_USER\Software\Microsoft\
Internet Account Manager\Accounts\WhoWhere

HKEY_CURRENT_USER\Software\Microsoft\
WAB\WAB4

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
{random key}
{random value} = {data}

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Privacy
CleanCookies = 0

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\0
1609 = 0