Submission Summary:

• Submission details:
• Submission received: 28 August 2012, 16:27:45
• Processing time: 7 min 53 sec
• Submitted sample:
• File MD5: 0x58B055705CB5D70192678E3AB28D944C
• File SHA-1: 0x60CA966AEC41966D6547F7EC5EC27058683DF93C
• Filesize: 110,368 bytes
• Alias:
• Trojan-Spy.Win32.Zbot.bfgu [Kaspersky Lab]
• PWS-Zbot.gen.ds [McAfee]
• Mal/Behav-010 [Sophos]
• PWS:Win32/Zbot.gen!Y [Microsoft]
• Trojan-Spy.Win32.Zbot [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AppData%\Hacog\abzi.bed	326 bytes	MD5: 0x295ACB0966E32797CD4B0B1593748B6D SHA-1: 0xBF02EFE7E3A75D954993132C461368E44C790621	(not available)
2	%AppData%\Hacog\abzi.tmp	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)
3	%AppData%\Yfubna\meyl.exe	110,368 bytes	MD5: 0xE6128F0D2868DF831ACF54BB7C56B049 SHA-1: 0x8383D9B11C4A7D110F7FB3700C25618DB7E3F523	Trojan-Spy.Win32.Zbot.bfgu [Kaspersky Lab] PWS-Zbot.gen.ds [McAfee] Mal/Behav-010 [Sophos] PWS:Win32/Zbot.gen!Y [Microsoft] Trojan-Spy.Win32.Zbot [Ikarus]
4	%Temp%\tmp0dc309b0.bat	168 bytes	MD5: 0xBCEB1AAC38FF7020CF5A5F27C570682B SHA-1: 0x8CF2660206CE682253283AD40FD5B7159EF3C5CA	(not available)
5	[file and pathname of the sample #1]	110,368 bytes	MD5: 0x58B055705CB5D70192678E3AB28D944C SHA-1: 0x60CA966AEC41966D6547F7EC5EC27058683DF93C	Trojan-Spy.Win32.Zbot.bfgu [Kaspersky Lab] PWS-Zbot.gen.ds [McAfee] Mal/Behav-010 [Sophos] PWS:Win32/Zbot.gen!Y [Microsoft] Trojan-Spy.Win32.Zbot [Ikarus]

• Notes:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

• The following directories were created:
• %AppData%\Hacog
• %AppData%\Yfubna

Memory Modifications

• There were new processes created in the system:

• There were new memory pages created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	106,496 bytes
cmd.exe	%System%\cmd.exe	106,496 bytes

• Notes:
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Registry Modifications

• The following Registry Keys were created:
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy
• HKEY_CURRENT_USER\Software\Microsoft\Zuwax

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy]
• CleanCookies = 0x00000000
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• {DD623955-1695-3ED3-3733-38AC7F1D6FC1} = ""%AppData%\Yfubna\meyl.exe""

so that meyl.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Microsoft\Zuwax]
• Payxi = E6 EA BB CC 6E 98 E5 66 B9 50 37 71 00 C0 1D 63 F5 AB 0E EF E2 D3 6E B7 ED F4 F4 FA DB 6B 7E 48 91 7E 3C F5 FB 24 0C 14 8A E3 19 9B 62 CF 2F 7C EF F5 F4 0D 39 82 67 C9 A1 89 D1 D2 84 E2 2E 03 E7 8D C7 14 BC CB 6F 8F 11 CE 61 E0 69 B7 E9 88 07 4E 16 2

• The following Registry Values were modified:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
• 1406 =
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
• 1406 =
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]
• 1406 =
• 1609 =

Other details

• To mark the presence in the system, the following Mutex object was created:
• Local\{10D0204C-0F8C-F361-3733-38AC7F1D6FC1}

• The following Host Name was requested from a host database:
• 192.5.5.241

• The following Internet Connection was established:

• The following GET request was made:
• zeus/config.bin