TSPY_ZBOT.BVQ

This spyware attempts to steal information, such as user names and passwords, used when logging into certain banking or finance-related websites.

Arrival Details

This spyware may be downloaded from the following remote sites:

• http://{BLOCKED}ikal.com/eu5.exe

Installation

This spyware adds the following folders:

• %Application Data%\{random1}
• %Application Data%\{random2}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It injects itself into the following processes running in the affected system's memory:

• explorer.exe
• taskhost.exe
• taskeng.exe
• Dwm.exe
• wscntfy.exe
• ctfmon.exe
• rdpclip.exe

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{GUID of mount point of %Windows%} = %Application Data%\{random1}\{random}.exe

It drops the following files:

• %Application Data%\{random1}\{random}.exe - copy of itself
• %Application Data%\{random2}\{random} - contains encrypted stolen data

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

Other System Modifications

This spyware creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%WINDOWS%\\EXPLORER.EXE = %WINDOWS%\EXPLORER.EXE:*:Enabled:Windows Explorer

Download Routine

This spyware connects to the following URL(s) to download its configuration file:

• http://{BLOCKED}ikal.com/eu5.bin

Information Theft

This spyware monitors the Internet Explorer (IE) activities of the affected system, specifically the address bar or title bar. It recreates a legitimate website with a spoofed login page if a user visits banking sites with the following strings in the address bar or title bar:

• *.co-operativebank.co.uk/CBIBSWeb/login.do
• *.co-operativebank.co.uk/CBIBSWeb/start.do
• *.smile.co.uk/SmileWeb/login.do
• *.smile.co.uk/SmileWeb/start.do
• */atl.osmp.ru/*
• */login.osmp.ru/*
• */v10/PT/jsp/privado/login.jsp?message
• *V10/PT/logon.aspx
• *activobank7.pt/v10/PT/jsp/privado/*
• *aforronet.igcp.pt/Iimf.AforroNet.UI/Services/Login/Login.aspx
• *bancobest.pt/ptg/start*
• *bancopopular.pt/App*/servlet/servin*
• *bancopopular.pt/AppGBP/servlet/servin*
• *bancopopular.pt/PopularWeb/BancaOnlineREDIR.aspx?*
• *bancopopular.pt/PopularWeb/BancaOnlineREDIR.aspx?VIA=*
• *bbva*/TLEU/tleu/jsp/pt/porN/home/index.jsp
• *bbvanetcash.com/BBVACASHMP*home.jsp
• *bbvanetcash.com/local_tls*
• *bes-sec.bes.pt/wclientes/axb*
• *bes-sec.bes.pt/wclientes/axb/tpl.asp?SRV=*
• *bigonline.pt/pt/logon_*/logon_user.asp
• *bpinet.pt*
• *bpinetempresas.pt*
• *bpn.pt*login.aspx
• *caixadirecta.cgd.pt*
• *caixadirecta.cgd.pt/CaixaDirecta/profile.do*
• *caixaebanking.cgd.pt/cebApp//Login_input.action
• *caixaebanking.cgd.pt/cebApp/Login_input.action
• *caixaebanking.cgd.pt/cebApp/Main.action
• *caonline.credito*gricola.pt/*
• *corporate.bpn.pt*login.aspx
• *corporate.bpn.pt/corporatebanking/v10/PT/aspx/empresas/recenseamento/autenticacao*
• *corporatebanking/v10/PT/aspx/empresas/recenseamento/autenticacao/logon.aspx
• *credito*gricola.pt*
• *empresas.santandertotta.pt/canalempresas/finance/login*
• *finibanco.pt/hbp/BemVindo.jsp?idSessao*
• *first-direct.com*
• *grupobanif.pt/xsite_be/BE/home/Autenticacao.jsp*
• *homebanking.bpn.pt*login.aspx
• *hsbc.co.uk/1/2*
• *hsbc.co.uk/1/2/!ut*
• *login_redirect_process*
• *millenniumbcp.pt/secure*jsessionid=*
• *net24.montepio.pt/Net24-Web/func/homePages/executa.jsp?*
• *net24.montepio.pt/Net24-Web/func/login/*Login*
• *particulares.santandertotta.pt/bepp/sanpt/usuarios/login*
• http://85.78.108.180/yabs/ex_jabber.php?q=
• http://85.78.108.180/yabs/sf_bachat.php?
• http://www.activobank7.pt/v10/PT/jsp/publico/homepage.html
• http://www.banif.pt*
• http://www.grupobanif.pt*
• https://*grupobanif.pt/xsite_be/BE/home/xlets/popupmsg.jsp*
• https://ibank.cahoot.com/Aquarius/web/en/core_banking/log_in/frameset_top_log_in.html
• https://ibank.cahoot.com/servlet/com*
• https://www.google.com/accounts/callmejabber/*
• https://www.google.com/accounts/ihateyouall/*

It attempts to steal information from the following banks and/or other financial institutions:

• Banco Popular
• Banif
• Co-Operativebank
• First Direct
• HSBC
• OSPM
• Smile

Drop Points

Stolen information is uploaded to the following websites:

• http://{BLOCKED}ikal.com/zs/gate.php

Other Details

This spyware does the following:

• It adds the following registry key as part of its installation routine:
  HKEY_CURRENT_USER\Software\Microsoft\{random}
• Adds the following registry entries to disable IE PhishingFilter:
  HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter Enabled =0
  HKEY_CURRENT_USER\Software\Microsoft\InternetExplorer\PhishingFilter EnabledV8 =0
• Steals the following information:
  • Personal Certificates (MY)
  • FTP credentials for the following FTP applications:
  • flashxp
  • ghisler
  • ipswitch
  • filezilla
  • ftpfar
  • winscp
  • ftpcommander
  • coreftp
  • smartftp
  • Flashplayer data
  • Internet session cookies

Variant Information

This spyware has the following MD5 hashes:

• 8bcee146140210ab39518c7904dccd60

It has the following SHA1 hashes:

• a567d88877774b227ae9fc88cb40996698e06a17