TSPY_ZBOT.MNY

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes the initially executed copy of itself.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This spyware drops the following copies of itself into the affected system:

• %Application Data%\{random folder name 1}\{random file name 1}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It drops the following files:

• %Application Data%\Microsoft\Address Book\winxp.wab - for all Windows OSs except Vista and 7
• %Application Data%\{random folder name 2}\{random file name 2}.{random file extension}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It creates the following folders:

• %Application Data%\{random folder name 1}
• %Application Data%\{random folder name 2}
• %Application Data%\Microsoft\Address Book - for all Windows OSs except Vista and 7

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random CLSID} = "%Application Data%\{random folder name 1}\{random file name 1}.exe"

Other System Modifications

This spyware adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
{random}

HKEY_CURRENT_USER\Software\Microsoft\
WAB

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\GloballyOpenPorts\
List
{random port number 1}:UDP = "{random port number 1}:UDP:*:Enabled:UDP {random port number 1}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\GloballyOpenPorts\
List
{random port number 2}:TCP = "{random port number 2}:TCP:*:Enabled:TCP {random port number 2}"

Drop Points

Stolen information is uploaded to the following websites:

• http://{pseudorandom domain name}.info
• http://{pseudorandom domain name}.com
• http://{pseudorandom domain name}.biz
• http://{pseudorandom domain name}.net
• http://{pseudorandom domain name}.org
• http://{pseudorandom domain name}.ru
• http://{pseudorandom domain name}.pl
• http://{pseudorandom domain name}.so

Other Details

This spyware connects to the following URL(s) to check for an Internet connection:

• http://www.google.com
• http://www.bing.com

It deletes the initially executed copy of itself

NOTES:

The URL where it connects is randomly generated using a randomizing function, which is computed based on the system's current date.

However, as of this writing, none of the malicious sites were accessible.

It may also gather the following information from the affected system:

• Data on cookie files (URLs)
• Email-related information such as account names, email addresses, passwords, server data, and server port
• Email information stored in the user’s Windows Address Book (WAB) file.