TSPY_ZBOT.A

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes then deletes itself afterward.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This spyware drops the following copies of itself into the affected system and executes them:

• %Application Data%\{random1}\{random}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It drops the following files:

• %Application Data%\{random2}\{random}.{random}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It creates the following folders:

• %Application Data%\{random1}
• %Application Data%\{random2}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It executes then deletes itself afterward.

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random} = "%Application Data%\{random}\{random}.exe"

Other System Modifications

This spyware adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
{random}
{random1} = "{hex values}"

HKEY_CURRENT_USER\Software\Microsoft\
{random}
{random2} = "{hex values}"

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
C:\WINDOWS\explorer.exe = "C:\WINDOWS\explorer.exe:*:Enabled:Windows Explorer"

Other Details

This spyware connects to the following URL(s) to check for an Internet connection:

• www.google.com.ph

It connects to the following possibly malicious URL:

• {BLOCKED}06-g5.free.fr
• {BLOCKED}8.{BLOCKED}9.251.247
• {BLOCKED}e.{BLOCKED}n.free.fr

NOTES:
It may also get stored passwords in the following registry locations:

• HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\Active Directory GC
• HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\Bigfoot
• HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\Verisign
• HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\WhoWhere

All gathered information are then saved and encrypted to the following file, and sent later on to its server:

• %Application Data%\{random2}\{random}.{random}