TSPY_ZBOT.YUYADD

This spyware arrives as attachment to mass-mailed email messages. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It modifies the Internet Explorer Zone Settings.

However, as of this writing, the said sites are inaccessible. It deletes itself after execution.

Arrival Details

This spyware arrives as attachment to mass-mailed email messages.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This spyware drops the following copies of itself into the affected system:

• %Application Data%\{random foldername 1}\{random filename 1}.exe

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following files:

• %Application Data%\{random foldername 2}\{random filename 2}.tmp
• %Application Data%\{random foldername 2}\{random filename 2}.{random extension}

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It creates the following folders:

• %Application Data%\{random foldername 1}
• %Application Data%\{random foldername 2}

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other System Modifications

This spyware adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
{random key 1}

It adds the following registry entries:

HKEY_CURRENT_USER
(Default) = "{hex values}"

HKEY_CURRENT_USER\Software\Microsoft\
{random key 1}
{random 1} = "{hex values}"

HKEY_CURRENT_USER\Software\Microsoft\
{random key 1}
{random 2} = "{hex values}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
WarnonBadCertRecving = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
EnableSPDY3_0 = "0"

Web Browser Home Page and Search Page Modification

This spyware modifies the Internet Explorer Zone Settings.

Other Details

This spyware connects to the following possibly malicious URL:

• http://{BLOCKED}ecialists.co.nz/claper/server/config.jpg

However, as of this writing, the said sites are inaccessible.

It deletes itself after execution.