TSPY_ZBOT.ADXK

This spyware may be dropped by other malware.

It steals email addresses from the Windows Address Book (WAB).

It deletes itself after execution.

Arrival Details

This spyware may be dropped by the following malware:

• TROJ_UPATRE.SMAI

It may be downloaded from the following remote sites:

• https://{BLOCKED}headnails.com/wp-content/uploads/2011/10/pdf.exe

Installation

This spyware drops the following copies of itself into the affected system and executes them:

• %Application Data%\{Random Folder}\{Random Filename}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It drops the following non-malicious file:

• %Application Data%\Microsoft\Address Book\{Username}.wab

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It creates the following folders:

• %Application Data%\{Random Folder}
• %Application Data%\Microsoft\Address Book

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It injects codes into the following process(es):

• All User Processes

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{Malware Filename} = "%Application Data%\{Random Folder}\{Random Filename}.exe"

Other System Modifications

This spyware adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
{Random Key}

HKEY_CURRENT_USER\Software\Microsoft\
WAB

HKEY_CURRENT_USER\Software\Microsoft\
WAB\WAB4

HKEY_CURRENT_USER\Software\Microsoft\
WAB\WAB4\Wab File Name

HKEY_CURRENT_USER\Software\Microsoft\
Internet Account Manager

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
{Random Key}
{Random} = "{Random Value}"

HKEY_CURRENT_USER\Software\Microsoft\
WAB\WAB4
OlkContactRefresh = "0"

HKEY_CURRENT_USER\Software\Microsoft\
WAB\WAB4
OlkFolderRefresh = "0"

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\GloballyOpenPorts\
List
6967:UDP = "6967:UDP:*:Enabled:UDP 6967"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\GloballyOpenPorts\
List
8628:TCP = "8628:TCP:*:Enabled:TCP 8628"

Information Theft

This spyware steals email addresses from the Windows Address Book (WAB).

Other Details

This spyware connects to the following URL(s) to check for an Internet connection:

• http://www.google.com/
• http://www.bing.com/

It deletes itself after execution.

NOTES:

This spyware uses the following mutex names:

• Local\{GUID}
• Global\{GUID}

It avoids to inject codes in all system processes.

It attempts to download its configuration file by connecting to randomly generated IP addresses. The configuration file may contain URLs where it downloads an updated copy of itself and where it sends its gathered information. It may also contain URLs of its target online banking and finance-related sites from where it steals the information.

It also collects information when it finds the following strings in running processes:

• bancline
• bankman
• cruisenet
• dirclt32.exe
• episys
• fastdoc
• fdmaster.exe
• fidelity
• gplusmain
• jack henry
• launchpadshell.exe
• micrsolv
• pcsws.exe
• prologue.exe
• silverlake
• tellerplus
• v48d0250s1
• vantiv
• wtng.exe