WINCE_ZBOT.B

This spyware is a variant of the ZBOT/ZeuS malware family that targets smartphones running on Windows Mobile. It intercept calls and text messages to steal user credentials used in online banking.

To get a one-glance comprehensive view of the behavior of this Spyware, refer to the Threat Diagram shown below.

It monitors SMS messages of an infected Windows mobile phone then forwards the message if the sender is listed in its monitored list.

Its primary objective is to steal authentication codes used in online banking. It sends and receives information/commands from a specific phone number.

It is a counterpart of SYMBOS_ZBOT.B and BBOS_ZITMO.B, which are for devices running on Symbian OS and BlackBerry OS, respectively. It is also a counterpart of TSPY_ZBOT.HQ, a Windows system malware.

This spyware may be unknowingly downloaded by a user while visiting malicious websites.

Arrival Details

This spyware may be unknowingly downloaded by a user while visiting malicious websites.

Other Details

This spyware does the following:

• Monitors text messages of an infected Windows Mobile phone then forwards these messages to the cybercriminal if the sender is listed in its monitored list
• Steals authentication codes used in online banking
• Sends and receives information/commands from the following phone number:
  
  • {BLOCKED}1481813
• Interprets the following messages as its backdoor commands:
  
  • ON/OFF - sets the malware state
  • SET ADMIN - sets a number as the command and control (C&C)
  • REM SENDER ALL - removes all senders from monitored list
  • ADD SENDER ALL - adds all contacts to the monitored list
  • BLOCK ON - blocks incoming calls is ON
  • BLOCK OFF - blocks incoming call is OFF
  • ADD SENDER - adds a number to the monitored list
  • REM SENDER - removes a number from the monitored list
  • SET SENDER - replaces all numbers in the monitored list with a new number
• Notifies the cybercriminal of this spyware's current status by sending any of the following messages:
  
  • App installed OK
  • Blocking is on
  • Blocking is off
  • Monitoring all
  • State is On
  • State is Off

NOTES:
This spyware is a counterpart of SYMBOS_ZBOT.B and BBOS_ZITMO.B, which are for devices running on Symbian OS and BlackBerry OS, respectively. It is also a counterpart of TSPY_ZBOT.HQ, a Windows system malware.