TROJ_ZBOT.DAL

It may be downloaded from the following remote sites:

http://schastlivieiveselierebyta0001.com/xed/yourbot.exe

It accesses the following site to download its configuration file:

http://schastlivieiveselierebyta0001.com/xed/recover.bin

http://schastlivieiveselierebyta0001.com/xed/config.bin

Stolen information is uploaded to the following websites:

http://schastlivieiveselierebyta0001.com/xed/gate.php

This Trojan attempts to steal information, such as user names and passwords, used when logging into certain banking or finance-related websites.

Arrival Details

This Trojan may be downloaded from the following remote sites:

• http://{BLOCKED}livieiveselierebyta0001.com/xed/yourbot.exe

Installation

This Trojan adds the following folders:

• %Application Data%\{random1}
• %Application Data%\{random2}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It injects itself into the following processes running in the affected system's memory:

• explorer.exe
• taskhost.exe
• taskeng.exe
• Dwm.exe
• wscntfy.exe
• ctfmon.exe
• rdpclip.exe

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{GUID of mount point of %Windows%} = %Application Data%\{random1}\{random}.exe

It drops the following files:

• %Application Data%\{random1}\{random}.exe - copy of itself
• %Application Data%\{random2}\{random} - contains encrypted stolen data

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

Other System Modifications

This Trojan adds the following registry keys as part of its installation routine:

HKEY_CURRENT_USER

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%WINDOWS%\\EXPLORER.EXE = %WINDOWS%\EXPLORER.EXE:*:Enabled:Windows Explorer

Information Theft

This Trojan monitors the Internet Explorer (IE) activities of the affected system, specifically the address bar or title bar. It recreates a legitimate website with a spoofed login page if a user visits banking sites with the following strings in the address bar or title bar:

• *.bankinter.com/www/es-es/cgi/*home*
• *.bankinter.com/www/es-es/cgi/*integral
• *.bankinter.com/www/es-es/cgi/ebk+opr*
• *.ccm.es*
• *.ccm.es/*inicio_identificacionAAAA*
• *.deutsche-bank.es*login*
• *.ingdirect.es*Transactional/faces/views/getClientID*
• *bancopastor.es/*SrPd*
• *banesnet.banesto.es*cabeza_bk*
• *banesnet.banesto.es*dse_nextEventName=start
• *banesnet.banesto.es*s.bto
• *banesnet.banesto.es/npage/loginEmpresas*
• *caixacatalunya.com*/es/ccpublic/*
• *caixadirecta.cgd.pt*
• *caixadirecta.cgd.pt/CaixaDirecta/login*
• *cajaduero.es*
• *cajaduero.es*microsite*
• *cajastur.es/*portal_inicio_identificacion*
• *e-pueyo.com*centro*
• *e-pueyo.com*opciones*
• *empresas.santandertotta.pt/canalempresas/finance/login*
• *grupobanif.pt/xsite_be/BE/home/Autenticacao*
• *lacajaencasa.cajacanarias.es*identificacion*
• *lloydstsb.es/VirtualBank/servlet/LoadMenuOperaciones*
• *online.halifax.es/main*
• *pastornetempresas.bancopastor.es/SrPd*
• *ps://pastornetparticulares.bancopastor.es/*SrPd*
• *ruralvia.com/isum/Main?ISUM_ID=portlets_area*
• *s://pastornetempresas.bancopastor.es/SrPd*
• *soldirecto.cajasoldirecto.es/BEWeb/*
• *ww3.deutsche-bank.es/*
• https://bancae.caixapenedes.com*
• https://bancae.caixapenedes.com/mcpenedesnl/*
• https://bancopostaimpresaonline.poste.it/bpiol/lastFortyMovementsBalance.do?method=loadLastFortyMovementList*
• https://banesnet.banesto.es*sugerencias*
• https://banesnet.banesto.es/*ChannelDriver*
• https://banking.postbank.de/app/finanzstatus.init.do*
• https://banking.postbank.de/app/tan.historie.input.do*viewmode=tan
• https://barclaysnet.barclays.es/servlet/com.ibm.dse.cs.servlet*
• https://be.bancogallego.es/inithome*
• https://be.cajamurcia.es/BEWeb/*ps0002m004_0*
• https://caixagestionempresas.caixagalicia.es/*/inicio_identificacion.action*
• https://cajacanariasonline.cajacanarias.es/*/inicio_identificacion_portal*
• https://cajaelectronica.caja-granada.es*inicio_identificacion*
• https://cajaelectronica.caja-granada.es/BEWeb/*.action*
• https://cajasturdirecto.cajastur.es/BEWeb/*
• https://ce.caixalaietana.es/BEWeb/2042/2042*_m_COMUN*
• https://enlinea.cajasur.es/BEWeb/*/inicio_identificacion*
• https://enlinea.cajasur.es/BEWeb/*pstexam_0*
• https://interconnexio*.bibm.ad/GeneralServlet
• https://interconnexio*.bibm.ad/GeneralServlet?pageOperation=INICIO_WELCOME*
• https://linea.sanostra.es/*login_identificacion*
• https://net.kutxa.net/*/tmpl/es/loginkn*
• https://net24.montepio.pt/Net24-Web/func/login/*
• https://oficina24hores.caixagirona.es/BEWeb/2030/1030/inicio_identificacion*
• https://oie.cajamadridempresas.es/CajaMadrid/oie/pt_oie/Login/*
• https://online.halifax.es/main*
• https://pastornetempresas.bancopastor.es/*SrPd*
• https://pastornetempresas.bancopastor.es/EMPBEEMPA_F.jsp?*
• https://pastornetempresas.bancopastor.es/titEMPBEEMPA*
• https://pastornetparticulares.bancopastor.es/*SrPd*
• https://pastornetparticulares.bancopastor.es/BEPBEBEPA_F.jsp
• https://pastornetparticulares.bancopastor.es/SrPd;jsessionid=*
• https://pastornetparticulares.bancopastor.es/titBEPBEBEPA*
• https://seguro.cam.es*SvlHistoricoMovimientosCAM*
• https://seguro.cam.es*SvlSaldoCAM*
• https://soldirecto.cajasoldirecto.es/BEWeb/*
• https://telematic.caixamanlleu.es/ISMC/Manlleu_cat/acceso*
• https://vitalnet.cajavital.es/BEWeb/*/inicio_identificacion*
• https://www.bancomediolanum.es/*
• https://www.bankinter.com*
• https://www.bvi.bancodevalencia.es/inithome*
• https://www.caixatarragona.es/*/oficinacodigo*
• https://www.cajaduero.es/CajaElectronica/boxer/*
• https://www.cajaespana.net/convivencia/servlet/ServletCTRL
• https://www.empresas.santandertotta.pt/canalempresas/finance/*
• https://www.empresas.santandertotta.pt/canalempresas/finance/patrimonio/*
• https://www.gruposantander.es/*
• https://www.iknet.iparkutxa.es/intro*
• https://www.lloydstsb.es/VirtualBank/*
• https://www.lloydstsb.es/VirtualBank/servlet/LoadMenuOperaciones*
• https://www.ruralvia.com/isum/Main*

It accesses the following site to download its configuration file:

• http://{BLOCKED}livieiveselierebyta0001.com/xed/recover.bin
• http://{BLOCKED}livieiveselierebyta0001.com/xed/config.bin

It attempts to steal information from the following banks and/or other financial institutions:

• ANZ
• Banco Pastor
• Banesto
• Banif
• Barclays
• CCM
• Caixa Girona
• Caixa Laietana
• Caixa Tarragona
• Caja Canarias
• Caja Granada
• Caja Madrid
• Caja Murcia
• Caja Vital
• Cajasol
• Kutxanet
• Lloyds
• PosteItaliane
• Santander

Drop Points

Stolen information is uploaded to the following websites:

• http://{BLOCKED}livieiveselierebyta0001.com/xed/gate.php

Other Details

This Trojan does the following:

• It adds the following registry entries to disable Internet Explorer:
  HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter Enabled =0
  HKEY_CURRENT_USER\Software\Microsoft\InternetExplorer\PhishingFilter EnabledV8 =0
• Steals the following information:
  Personal Certificates (MY)
  FTP credentials for the following FTP applications:
  flashxp
  ghisler
  ipswitch
  filezilla
  ftpfar
  winscp
  ftpcommander
  coreftp
  smartftp
  Flashplayer data
  Internet session cookies

Variant Information

This Trojan has the following MD5 hashes:

• 71cb8fcb77be3a5eeed4542b71399fab

It has the following SHA1 hashes:

• bd3d1bd440173ce8cd03f0b12e4eca067ea4957e