Submission Summary:

• Submission details:
• Submission received: 15 August 2012, 22:54:38
• Processing time: 7 min 56 sec
• Submitted sample:
• File MD5: 0x4B8001CAA9A5E7216177012722558387
• File SHA-1: 0x6A39BF17B22235F688ADBEF0EA874319498651F8
• Filesize: 575,066 bytes
• Alias:
• Trojan-Spy.Win32.Zbot.bopd [Kaspersky Lab]
• Trojan-Spy.Win32.Zbot [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AppData%\Fofax\muilo.avo	1,277 bytes	MD5: 0xE51798E05C3484361F6286205E6C91E7 SHA-1: 0xF11F373AA770D06C9ADD75949D4A219BFABBF420	(not available)
2	%AppData%\Fofax\muilo.tmp	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)
3	%AppData%\Muquo\emfo.exe	141,312 bytes	MD5: 0xE317437A0D2E9ED8DD3D50285C80AA52 SHA-1: 0x829D8857A8225308B2845D03268BC608E134B40C	Trojan-Spy.Win32.Zbot.bopd [Kaspersky Lab] PWS-Zbot.gen.ds [McAfee] Troj/PWS-BSF [Sophos] PWS:Win32/Zbot.gen!Y [Microsoft] Trojan-Spy.Win32.Zbot [Ikarus]
4	%Temp%\ckz_XH7Y\tt.bat	64 bytes	MD5: 0xE8F74887CBF6654955B8C72FA4DA9A85 SHA-1: 0xA4741F4DC2269EBD88D65EF28F438DCF3E88F654	(not available)
5	%Temp%\ckz_XH7Y\tt.pdf	9,283 bytes	MD5: 0xCAABACF7A86F357BD3C92FE6E7DBB95A SHA-1: 0xF1137B5EA249AE17551C3CB065CFAB7FAAA06193	(not available)
6	[file and pathname of the sample #1]	575,066 bytes	MD5: 0x4B8001CAA9A5E7216177012722558387 SHA-1: 0x6A39BF17B22235F688ADBEF0EA874319498651F8	Trojan-Spy.Win32.Zbot.bopd [Kaspersky Lab] Trojan-Spy.Win32.Zbot [Ikarus]

• Notes:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

• The following directories were created:
• %AppData%\Fofax
• %AppData%\Muquo
• %Temp%\ckz_XH7Y

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
emfo.exe	%AppData%\Muquo\emfo.exe	159,744 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	495,616 bytes
tt.exe	%Temp%\ckz_XH7Y\tt.exe	159,744 bytes

Registry Modifications

• The following Registry Keys were created:
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy
• HKEY_CURRENT_USER\Software\Microsoft\Yznuc

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Identities]
• Identity Login = 0x00098053
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy]
• CleanCookies = 0x00000000
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• {42D277CD-CDF6-AE45-AAC8-FE0F803CAE20} = ""%AppData%\Muquo\emfo.exe""

so that emfo.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Microsoft\Yznuc]
• Yfomduto = 77 F1 10 EA EF B5 49 DD 0E 20 7B B9 38 32 3D E9 65 5D 03 D4 D2 D3 E3 C4 3B 03 98 6D 62 D2 15 78 22 FC 01 51 AF FF F3 2E 6D 76 F3 1F DD CB CB D0 34 A5 49 4B EC CA 1A BC 50 FA 10 7C 01 23 93 D9 CF 80 A9 E6 12 26 FF 58 31 03 40 E1 03 8E 27 C3 DA ED 21 A

• The following Registry Values were modified:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
• 1406 =
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
• 1406 =
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]
• 1406 =
• 1609 =

Other details

• To mark the presence in the system, the following Mutex object was created:
• Local\{8F606ED4-D4EF-63F7-AAC8-FE0F803CAE20}

• The following Internet Connections were established:

• The following GET requests were made:
• ez1/data.bin
• pub/adobe/acrobat/js/6.x/rdr/win/enu/DataScript.js