ThreatExpert Report: Trojan-Spy.Win32.Zbot.idq, Infostealer.Banker.C, Mal/Zbot-G..

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 19 December 2008, 04:11:03
Processing time: 7 min 54 sec
Submitted sample:

File MD5: 0x89D51FD55935F79C90106AB2C5B2FF66
File SHA-1: 0x98F9C65FBF5D13F5A2E3125BF94C49AFF73A73DE
Filesize: 94,208 bytes
Alias:

Infostealer.Banker.C [Symantec]
Trojan-Spy.Win32.Zbot.idq [Kaspersky Lab]
Mal/Zbot-G [Sophos]
TrojanSpy:Win32/Zbot.gen!C [Microsoft]
Virus.Win32.Enteos [Ikarus]

Summary of the findings:

What's been found	Severity Level
Threat characteristics of ZBot - a banking trojan that disables firewall, steals sensitive financial data (credit card numbers, online banking login details), makes screen snapshots, downloads additional components, and provides a hacker with the remote access to the compromised system.
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Trojan-Spy.Zbot.YETH	Trojan-Spy.Zbot.YETH is a rootkit trojan which steals online banking information and downloads other malware as well.

Attention! The following threat categories were identified:

Threat Category	Description
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Profiles%\NetworkService\Application Data\twain_32\user.ds	108 bytes	MD5: 0x1DF945C6C5066C49F28A7CBBDE0EC55A SHA-1: 0x1BF1EAE2B6DF9B7870737FE8882DA8562979464F	(not available)
2	%Profiles%\NetworkService\Cookies\index.dat	16,384 bytes	MD5: 0xCE338FE6899778AACFC28414F2D9498B SHA-1: 0x897256B6709E1A4DA9DABA92B6BDE39CCFCCD8C1	(not available)
3	%Profiles%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\CSY9B5CP\desktop.ini %Profiles%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\CZ9SBCMA\desktop.ini %Profiles%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\OLVIOBH0\desktop.ini %Profiles%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\S06NR08K\desktop.ini	67 bytes	MD5: 0x4A3DEB274BB5F0212C2419D3D8D08612 SHA-1: 0xFA52F823B821155CF0EC527D52CE9B1390EC615E	(not available)
4	%Profiles%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat	32,768 bytes	MD5: 0xBB7DF04E1B0A2570657527A7E108AE23 SHA-1: 0x5188431849B4613152FD7BDBA6A3FF0A4FD6424B	(not available)
5	[file and pathname of the sample #1]	94,208 bytes	MD5: 0x89D51FD55935F79C90106AB2C5B2FF66 SHA-1: 0x98F9C65FBF5D13F5A2E3125BF94C49AFF73A73DE	Infostealer.Banker.C [Symantec] Trojan-Spy.Win32.Zbot.idq [Kaspersky Lab] Mal/Zbot-G [Sophos] TrojanSpy:Win32/Zbot.gen!C [Microsoft] Virus.Win32.Enteos [Ikarus]
6	%System%\twain_32\local.ds	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)
7	%System%\twain_32\user.ds	209 bytes	MD5: 0x052AA787B77213EF60DA8931A1559288 SHA-1: 0xB69D1E17494C28DFD9FDD3FB8CFD6381A36D82D9	(not available)
8	%System%\twext.exe	215,552 bytes	MD5: 0x9120193BE9FCFA028A5A55E544EA96EA SHA-1: 0x6F656D53320A4D0268B3D188898F2F0933A3840E	Infostealer.Banker.C [Symantec] Trojan-Spy.Win32.Zbot.idq [Kaspersky Lab] Mal/Zbot-G [Sophos] TrojanSpy:Win32/Zbot.gen!C [Microsoft] Virus.Win32.Enteos [Ikarus]

Notes:

%Profiles% is a variable that refers to the file system directory containing user profile folders. A typical path is C:\Documents and Settings.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

The following directories were created:

%Profiles%\NetworkService\Application Data\twain_32
%Profiles%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\CSY9B5CP
%Profiles%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\CZ9SBCMA
%Profiles%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\OLVIOBH0
%Profiles%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\S06NR08K
%System%\twain_32

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	208,896 bytes

There were new memory pages created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
services.exe	%System%\services.exe	4,096 bytes
lsass.exe	%System%\lsass.exe	4,096 bytes
svchost.exe	%System%\svchost.exe	4,096 bytes
svchost.exe	%System%\svchost.exe	4,096 bytes
svchost.exe	%System%\svchost.exe	4,096 bytes
svchost.exe	%System%\svchost.exe	4,096 bytes
alg.exe	%System%\alg.exe	4,096 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\{334613DB-50C1-B3BE-95ED-E9915A134FF1}
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\{43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6}
HKEY_USERS\.DEFAULT\Software\Microsoft\Protected Storage System Provider

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network]

UID = "%ComputerName%_0003FE27"

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\{334613DB-50C1-B3BE-95ED-E9915A134FF1}]

{F710FA10-2031-3106-8872-93A2B5C5C620} = F7 09 F2 0D
{E716FA10-2031-AA96-8E72-93A205C5C62C} = 47 09 F2 0D

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\{43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6}]

{F710FA10-2031-3106-8872-93A2B5C5C620} = F7 09 F2 0D
{E716FA10-2031-AA96-8E72-93A205C5C62C} = 47 09 F2 0D

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

ProxyEnable = 0x00000000

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]

Directory = "%Profiles%\LocalService\Local Settings\Temporary Internet Files\Content.IE5"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]

CachePath = "%Profiles%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]

CachePath = "%Profiles%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]

CachePath = "%Profiles%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]

CachePath = "%Profiles%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

Userinit = "%System%\userinit.exe,%System%\twext.exe,"

so that twext.exe runs every time Windows starts

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]

Cookies = "%Profiles%\LocalService\Cookies"
History = "%Profiles%\LocalService\Local Settings\History"

Other details

Analysis of the file resources indicate the following possible country of origin:

Russian Federation

To mark the presence in the system, the following Mutex object was created:

__SYSTEM__91C38905__

The following Internet Connection was established:

Server Name	Server Port	Connect as User	Connection Password
igorhhasy.ru	80	(null)	(null)

The following GET request was made:

igor/conf.bin

The following HTTP URLs were started reading:

http://igorhhasy.ru/igor/conf.exe
http://igorhhasy.ru/igor/conf.php
http://wfrules.ru/wfrules2.php
http://reservpptppp20.ru/igor.bin
http://reservpptppp7777.ru/igor.bin

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.