TSPY_ZBOT.SMIG

This ZBOT variant drops a configuration file that contains a list of its targeted banks and other financial sites. It also steals information from different FTP sites and steals personal certificates from the infected system. It is also related to incorporating the scripting language, AutoIt, which makes malware analysis an arduous task.

To get a one-glance comprehensive view of the behavior of this Spyware, refer to the Threat Diagram shown below.

This spyware may be dropped by other malware.

It modifies Internet Explorer security settings. This puts the affected computer at greater risk, as it allows malicious URLs to be accessed by the computer.

It attempts to steal information, such as user names and passwords, used when logging into certain banking or finance-related websites.

Arrival Details

This spyware may be dropped by the following malware:

• TSPY_ZBOT.ZKW

Installation

This spyware drops the following copies of itself into the affected system and executes them:

• %Application Data%\{random folder 2}\{random file name}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It drops the following files:

• %System Root%\debug.txt
• %Application Data%\{random folder 1}\{random file name}.{random extension}
• %Application Data%\Microsoft\Address Book\{user name}.wab
• %Application Data%\Microsoft\Address Book\{user name}.wab~

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It creates the following folders:

• %Application Data%\{random folder 1}
• %Application Data%\{random folder 2}
• %Application Data%\Microsoft\Address Book

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It injects codes into the following process(es):

• explorer.exe

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{GUID} = "%Application Data%\{random folder 2}\{random file name}.exe"

Other System Modifications

This spyware adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
{random key}

HKEY_CURRENT_USER\Software\Microsoft\
WAB

HKEY_CURRENT_USER\Software\Microsoft\
WAB\WAB4

HKEY_CURRENT_USER\Software\Microsoft\
WAB\WAB4\Wab File Name

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Privacy

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
{random key}
{random} = "{random}"

HKEY_CURRENT_USER\Software\Microsoft\
WAB\WAB4
OlkContactRefresh = "0"

HKEY_CURRENT_USER\Software\Microsoft\
WAB\WAB4
OlkFolderRefresh = "0"

HKEY_CURRENT_USER\Software\Microsoft\
WAB\WAB4
FirstRun = "1"

HKEY_CURRENT_USER\Software\Microsoft\
WAB\WAB4\Wab File Name
(Default) = "%Application Data%\Microsoft\Address Book\{user name}.wab"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Privacy
CleanCookies = "0"

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%Windows%\explorer.exe = "%Windows%\explorer.exe:*:Enabled:Windows Explorer"

Web Browser Home Page and Search Page Modification

This spyware modifies Internet Explorer zone settings.

Download Routine

This spyware downloads an updated copy of itself from the following website(s):

• http://{BLOCKED}arkbot.com/arxl/chithre/bot.exe

It connects to the following URL(s) to download its configuration file:

• http://{BLOCKED}arkbot.com/arxl/chithre/config.bin

Information Theft

This spyware attempts to access a website to download a file which contains information where the Trojan can download an updated copy of itself, and where to send its stolen data. This configuration file also contains the following list of targeted bank-related websites from which it steals information:

• *.ebay.com/*eBayISAPI.dll?*
• *//mail.yandex.ru/index.xml
• *//mail.yandex.ru/
• *//money.yandex.ru/
• *//money.yandex.ru/index.xml
• */atl.osmp.ru/*
• */login.osmp.ru/*
• */my.ebay.com/*CurrentPage=MyeBayPersonalInfo*
• *banquepopulaire.fr/*
• *wellsfargo.com/*
• http://*.osmp.ru/
• http://caixasabadell.net/banca2/tx0011/0011.jsp
• http://www.hsbc.co.uk/1/2/personal/internet-banking*
• https://areasegura.banif.es/bog/bogbsn*
• https://banca.cajaen.es/Jaen/INclient.jsp
• https://bancaonline.openbank.es/servlet/PProxy?*
• https://bancopostaonline.poste.it/bpol/bancoposta/formslogin.asp
• https://banesnet.banesto.es/*/loginEmpresas.htm
• https://banking*.anz.com/*
• https://cardsonline-consumer.com/RBSG_Consumer/VerifyLogin.do
• https://carnet.cajarioja.es/banca3/tx0011/0011.jsp
• https://easyweb*.tdcanadatrust.com/servlet/*FinancialSummaryServlet*
• https://empresas.gruposantander.es/WebEmpresas/servlet/webempresas.servlets.*
• https://extranet.banesto.es/*/loginParticulares.htm
• https://extranet.banesto.es/npage/OtrosLogin/LoginIBanesto.htm
• https://hb.quiubi.it/newSSO/x11logon.htm
• https://home.cbonline.co.uk/login.html*
• https://home.ybonline.co.uk/login.html*
• https://home.ybonline.co.uk/ral/loginmgr/*
• https://home2ae.cd.citibank.ae/CappWebAppAE/producttwo/capp/action/signoncq.do
• https://ibank.barclays.co.uk/olb/x/LoginMember.do
• https://ibank.internationalbanking.barclays.com/logon/icebapplication*
• https://intelvia.cajamurcia.es/2043/entrada/01entradaencrip.htm
• https://internetbanking.aib.ie/hb1/roi/signon
• https://light.webmoney.ru/default.aspx
• https://lot-port.bcs.ru/names.nsf?#ogin*
• https://montevia.elmonte.es/cgi-bin/INclient_2098*
• https://oi.cajamadrid.es/CajaMadrid/oi/pt_oi/Login/login
• https://oie.cajamadridempresas.es/CajaMadrid/oie/pt_oie/Login/login_oie_1
• https://olb2.nationet.com/MyAccounts/frame_MyAccounts_WP2.asp*
• https://olb2.nationet.com/signon/signon*
• https://online*.lloydstsb.co.uk/logon.ibc
• https://online-business.lloydstsb.co.uk/customer.ibc
• https://online-offshore.lloydstsb.com/customer.ibc
• https://online.wamu.com/Servicing/Servicing.aspx?targetPage=AccountSummary
• https://online.wellsfargo.com/das/cgi-bin/session.cgi*
• https://online.wellsfargo.com/login*
• https://online.wellsfargo.com/signon*
• https://onlinebanking#.wachovia.com/myAccounts.aspx?referrer=authService
• https://onlinebanking.nationalcity.com/OLB/secure/AccountList.aspx
• https://onlinebanking.norisbank.de/norisbank/login.do?method=login* GP
• https://onlineeast#.bankofamerica.com/cgi-bin/ias/*/GotoWelcome
• https://pastornetparticulares.bancopastor.es/SrPd*
• https://privati.internetbanking.bancaintesa.it/sm/login/IN/box_login.jsp
• https://probanking.procreditbank.bg/main/main.asp*
• https://resources.chase.com/MyAccounts.aspx
• https://rupay.com/index.php
• https://scrigno.popso.it*
• https://web.da-us.citibank.com/*BS_Id=MemberHomepage*
• https://web.da-us.citibank.com/cgi-bin/citifi/portal/l/autherror.do*
• https://web.da-us.citibank.com/cgi-bin/citifi/portal/l/l.do
• https://web.secservizi.it/siteminderagent/forms/login.fcc
• https://welcome23.smile.co.uk/SmileWeb/start.do
• https://welcome27.co-operativebank.co.uk/CBIBSWeb/start.do
• https://www#.citizensbankonline.com/*/index-wait.jsp
• https://www#.usbank.com/internetBanking/LoginRouter
• https://www*.banking.first-direct.com/1/2/*
• https://www.53.com/servlet/efsonline/index.html*
• https://www.bancajaproximaempresas.com/ControlEmpresas*
• https://www.bancoherrero.com/es/*
• https://www.bbvanetoffice.com/local_bdno/login_bbvanetoffice.html
• https://www.bgnetplus.com/niloinet/login.jsp
• https://www.caixagirona.es/cgi-bin/INclient_2030*
• https://www.caixalaietana.es/cgi-bin/INclient_2042
• https://www.caixaontinyent.es/cgi-bin/INclient_2045
• https://www.caixatarragona.es/esp/sec_1/oficinacodigo.jsp
• https://www.caja-granada.es/cgi-bin/INclient_2031
• https://www.cajabadajoz.es/cgi-bin/INclient_6010*
• https://www.cajacanarias.es/cgi-bin/INclient_6065
• https://www.cajacirculo.es/ISMC/Circulo/acceso.jsp
• https://www.cajadeavila.es/cgi-bin/INclient_6094
• https://www.cajalaboral.com/home/acceso.asp
• https://www.cajasoldirecto.es/2106/*
• https://www.cajavital.es/Appserver/vitalnet*
• https://www.ccm.es/cgi-bin/INclient_6105
• https://www.citibank.de*
• https://www.clavenet.net/cgi-bin/INclient_7054
• https://www.dab-bank.com*
• https://www.e-gold.com/acct/balance.asp*
• https://www.e-gold.com/acct/li.asp
• https://www.ebank.hsbc.co.uk/main/IBLogon.jsp
• https://www.fibancmediolanum.es/BasePage.aspx*
• https://www.gbw2.it/cbl/jspPages/form_login_AV.jsp* GP
• https://www.gruposantander.es/*
• https://www.gruposantander.es/bog/sbi*?ptns=acceso*
• https://www.gruppocarige.it/grps/vbank/jsp/login.jsp
• https://www.halifax-online.co.uk/_mem_bin/*
• https://www.halifax-online.co.uk/_mem_bin/formslogin.asp*
• https://www.halifax-online.co.uk/MyAccounts/MyAccounts.aspx*
• https://www.in-biz.it* GP
• https://www.isbank.com.tr/Internet/ControlLoader.aspx*
• https://www.isideonline.it/relaxbanking/sso.Login*
• https://www.iwbank.it/private/index_pub.jhtml*
• https://www.mybank.alliance-leicester.co.uk/login/*
• https://www.nwolb.com/Login.asp*
• https://www.nwolb.com/Login.aspx*
• https://www.paypal.com/*/webscr?cmd=_account
• https://www.paypal.com/*/webscr?cmd=_login-done*
• https://www.rbsdigital.com/Login.asp*
• https://www.sabadellatlantico.com/es/*
• https://www.suntrust.com/portal/server.pt*parentname=Login*
• https://www.unicaja.es/PortalServlet*
• https://www.uno-e.com/local_bdnt_unoe/Login_unoe2.html
• https://www.us.hsbc.com/*
• https://www.wellsfargo.com/*
• https://www2.bancopopular.es/AppBPE/servlet/servin*

It attempts to steal information from the following banks and/or other financial institutions:

• Allied Irish Banks
• ANZ
• Banca Intesa
• Bancaja
• Banco Mediolanum
• Banco Pastor
• Banco Popular
• Banco Sabadell
• Banesto
• Banif
• Bank of America
• Banque Populaire
• Barclays
• BBVANet Office
• Business Bank of Turkey
• Caixa Girona
• Caixa Laietana
• Caixa Ontinyent
• Caixa Sabadell
• Caixa Tarragona
• Caja Badajoz
• Caja de Avila
• Caja Granada
• Caja Laboral
• Caja Madrid
• Caja Murcia
• Caja Rioja
• Caja Vital
• CajaCanarias
• Cajacirculo
• Cajasol
• Cards Online
• CCM
• Chase
• Citibank
• Citizens Bank
• Clavenet
• Clydesdale Bank
• Co-operative Bank
• DAB Bank
• E-gold
• Ebay
• Fifth Third Bank
• First Direct
• Gruppo Carige
• Halifax
• HSBC
• Inbiz
• IW Bank
• Keeper Light - WebMoney
• Lloyds TSB
• Monte Dei Paschi Di Siena
• National City
• Nationwide
• NatWest
• Norisbank
• Openbank
• Paypal
• Poste Italiane
• ProCredit Bank
• Qui UBI
• Relax Banking
• Royal Bank of Scotland
• RuPay
• Sabadell Atlantico
• Santander
• SCRIGNO
• Sec Servizi
• Smile
• SunTrust
• TD Canada Trust
• U.S. Bank
• Unicaja
• Uno-e
• Wachovia
• Washington Mutual
• Wells Fargo
• Yandex
• Yorkshire Bank

It gathers the following data:

• Personal certificates

It attempts to steal stored account information used in the following installed File Transfer Protocol (FTP) clients or file manager software:

• FlashXP
• TotalCommander
• WS_FTP
• Filezilla
• FTP Commander
• Smart FTP

Drop Points

Stolen information is uploaded to the following websites:

• http://{BLOCKED}arkbot.com/arxl/chithre/gate.php

NOTES:
It drops %System Root%\debug.txt which contains log of its behavior.