TSPY_ZBOT.UCV

This spyware arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It may be unknowingly downloaded by a user while visiting malicious websites.

It modifies the Internet Explorer Zone Settings.

It terminates itself if it detects it is being run in a virtual environment. However, as of this writing, the said sites are inaccessible.

Arrival Details

This spyware arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This spyware drops the following non-malicious files:

• %User Profile%\Application Data\{random folder name 2}\{random file name 2}.{random extension name}

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It drops the following copies of itself into the affected system:

• %User Profile%\Application Data\{random folder name 1}\{random file name 1}.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It injects itself into the following processes running in the affected system's memory:

• explorer.exe

It creates the following folders:

• %User Profile%\Application Data\{random folder name 1}
• %User Profile%\Application Data\{random folder name 2}

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Global\{random GUID}
• Local\{random GUID}

It terminates the execution of the copy it initially executed and executes the copy it drops instead.

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{GUID} = "%User Profile%\Application Data\{random folder name 1}\{random file name 1}.exe"

Other System Modifications

This spyware adds the following registry keys as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
{random}

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\AuthorizedApplications\
List
%windir%\explorer.exe = "%windir%\explorer.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%windir%\explorer.exe = "%windir%\explorer.exe"

Web Browser Home Page and Search Page Modification

This spyware modifies the Internet Explorer Zone Settings.

Information Theft

This spyware accesses the following site to download its configuration file:

• http://{BLOCKED}or.ru/makedocs.php

Other Details

This spyware terminates itself if it detects it is being run in a virtual environment.

However, as of this writing, the said sites are inaccessible.

NOTES:

This spyware may monitor several finance-related institutions depending on the contents of the configuration file. The configuration file also contains the drop zone where it sends stolen information, the URL where the configuration file can be downloaded, the codes for web inject, and the monitored URLs.