TSPY_ZBOT.LDG

This spyware may be downloaded by other malware/grayware from remote sites. It may be downloaded from remote sites by other malware.

It is injected into all running processes to remain memory resident.

It modifies Internet Explorer security settings. This puts the affected computer at greater risk, as it allows malicious URLs to be accessed by the computer.

It deletes the initially executed copy of itself.

Arrival Details

This spyware may be downloaded by the following malware/grayware from remote sites:

• http://{BLOCKED}heband.gr/5Wjm3iV2.exe
• http://{BLOCKED}ogalurunler.com/9BMu2.exe
• http://{BLOCKED}rimurunleri.com/rRq.exe
• http://{BLOCKED}alexchange.com/19J.exe
• http://{BLOCKED}s.org/1vAWoxz3.exe
• http://www.10130138.{BLOCKED}arn.de/4pxp.exe
• http://{BLOCKED}fttechnologies.com/iDm9vs.exe
• http://{BLOCKED}ution.com.br/jq5.ex
• http://{BLOCKED}inart.be/Ue7cHNm.exe
• http://{BLOCKED}oit.pl/ZBrBpBh2.exe

It may be downloaded from remote site(s) by the following malware:

• TSPY_FAREIT.ABVV

Installation

This spyware drops the following copies of itself into the affected system:

• %User Profile%\Application Data\{random folder name}\{random file name}.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It then creates the following non-malicious file(s):

• %User Profile%\Application Data\Microsoft\Address Book\{user name}.wab

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It creates the following folders:

• %User Profile%\Application Data\{random folder name}

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It is injected into all running processes to remain memory resident.

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Global\{GUID}
• Local\{GUID}

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{GUID} = "%User Profile%\Application Data\{random folder name}\{random file name}.exe"

Other System Modifications

This spyware adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
{random key name}

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
WAB\WAB4\Wab File Name
(Default) = "%User Profile%\Application Data\Microsoft\Address Book\{user name}.wab"

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%Windows%\explorer.exe = "%Windows%\explorer.exe:*:Enabled:Windows Explorer"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\GloballyOpenPorts\
List
{port}:TCP = "{port}:TCP:Enabled:TCP {port}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\GloballyOpenPorts\
List
{port}:UDP = "{port}:UDP:Enabled:UDP {port}"

Web Browser Home Page and Search Page Modification

This spyware modifies Internet Explorer zone settings.

Information Theft

This spyware accesses the following site to download its configuration file:

• http://{pseudorandom alpha characters}.com
• http://{pseudorandom alpha characters}.biz
• http://{pseudorandom alpha characters}.org
• http://{pseudorandom alpha characters}.info
• http://{pseudorandom alpha characters}.net
• http://{pseudorandom alpha characters}.ru

Other Details

This spyware connects to the following URL(s) to check for an Internet connection:

• http://www.bing.com/
• http://www.google.com/

It deletes the initially executed copy of itself

NOTES:

The configuration file may contain URLs where it downloads an updated copy of itself and where it sends its gathered information.

This spyware may also gather the following information from the affected system:

• Data on Cookie files (URLs)
• Email-related information such as account names, email addresses, passwords, server data, and server port
• Email information stored in the user’s Windows Address Book (WAB) file