TSPY_ZBOT.HSK

This malware may arrive via spammed messages containing links where copies of it may be downloaded.

It steals sensitive online credentials related to online banking by monitoring browser activity.

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be downloaded unknowingly by a user when visiting malicious website(s).

It is injected into all running processes to remain memory resident.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be downloaded unknowingly by a user when visiting the following malicious website(s):

• http://www.{BLOCKED}oyuan.com/v7a47NA.exe

Installation

This spyware drops the following files:

• %Application Data%\{random letters 1}\{random letters}.exe - copy of itself
• %Application Data%\{random letters 2}\{random letters}.{random letters} - encrypted file

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It creates the following folders:

• %Application Data%\{random letters 1}
• %Application Data%\{random letters 2}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It is injected into all running processes to remain memory resident.

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
GUID = "%Application Data%\{random letters 1}\{random letters}.exe"

Other System Modifications

This spyware adds the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%Windows%\explorer.exe = "%Windows%\explorer.exe:*:Disabled:Windows Explorer"

It adds the following registry keys as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
{random letters}

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\0
1609 = "0"

(Note: The default value data of the said registry entry is "1".)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\1
1406 = "0"

(Note: The default value data of the said registry entry is "1".)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\1
1609 = "0"

(Note: The default value data of the said registry entry is "1".)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\2
1609 = "0"

(Note: The default value data of the said registry entry is "1".)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
1406 = "0"

(Note: The default value data of the said registry entry is "3".)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
1609 = "0"

(Note: The default value data of the said registry entry is "1".)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\4
1406 = "0"

(Note: The default value data of the said registry entry is "3".)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\4
1609 = "0"

(Note: The default value data of the said registry entry is "1".)

Download Routine

This spyware accesses the following websites to download files:

• http://{pseudorandom alpha characters}.biz
• http://{pseudorandom alpha characters}.org
• http://{pseudorandom alpha characters}.info
• http://{pseudorandom alpha characters}.net
• http://{pseudorandom alpha characters}.com

NOTES:

The URL where it connects to is randomly generated using a randomizing function, which is computed based on the system's current date. The download file the configuration file that contains the list of sites to be monitored.

It may also gather the following information from the affected system:

• Data on Cookie files (URLs)
• Email-related information such as account names, email addresses, passwords, server data, and server port
• Email information stored in the user’s Windows Address Book (WAB) file