Submission Summary:

• Submission details:
• Submission received: 5 October 2012, 22:19:45
• Processing time: 8 min 10 sec
• Submitted sample:
• File MD5: 0xC66643B5DB130109E90CED0DB61F97DE
• File SHA-1: 0x39D4E38333D4885D49F9A8FCDC5E9D0F2112C559
• Filesize: 575,066 bytes
• Alias:
• Trojan-Spy.Win32.Zbot.bopd [Kaspersky Lab]
• Trojan-Spy.Win32.Zbot [Ikarus]

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AppData%\Ezuv\evqi.exe	141,312 bytes	MD5: 0x91CDA188C10CEBAB91662F7619730A76 SHA-1: 0xB3D1B98394B6A867DFDF9A7C5AA8F61A33955FA0	Trojan-Spy.Win32.Zbot.bopd [Kaspersky Lab] PWS-Zbot.gen.ds [McAfee] Troj/PWS-BSF [Sophos] PWS:Win32/Zbot.gen!Y [Microsoft] Trojan-Spy.Win32.Zbot [Ikarus]
2	%AppData%\Faygl\kael.coy	1,277 bytes	MD5: 0xE2E9568CB6638318EDD7C5496011D295 SHA-1: 0x0112FA1BDA2CEBA4529123AF03FD64FFAA27DB36	(not available)
3	%AppData%\Faygl\kael.tmp	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)
4	%Temp%\ckz_X2Q8\quotation.pdf	9,283 bytes	MD5: 0xCAABACF7A86F357BD3C92FE6E7DBB95A SHA-1: 0xF1137B5EA249AE17551C3CB065CFAB7FAAA06193	(not available)
5	%Temp%\ckz_X2Q8\quote.bat	81 bytes	MD5: 0xEE4790E2060EF60CF5F70FBFE389E29E SHA-1: 0x774A416A5175E93AF83FA101DF96943D26CAB8BC	(not available)
6	[file and pathname of the sample #1]	575,066 bytes	MD5: 0xC66643B5DB130109E90CED0DB61F97DE SHA-1: 0x39D4E38333D4885D49F9A8FCDC5E9D0F2112C559	Trojan-Spy.Win32.Zbot.bopd [Kaspersky Lab] Trojan-Spy.Win32.Zbot [Ikarus]

• Notes:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

• The following directories were created:
• %AppData%\Ezuv
• %AppData%\Faygl
• %Temp%\ckz_X2Q8

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
evqi.exe	%AppData%\Ezuv\evqi.exe	159,744 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	495,616 bytes
quote.exe	%Temp%\ckz_X2Q8\quote.exe	159,744 bytes

Registry Modifications

• The following Registry Keys were created:
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy
• HKEY_CURRENT_USER\Software\Microsoft\Iqdo

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Identities]
• Identity Login = 0x00098053
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy]
• CleanCookies = 0x00000000
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• {A38961E6-8847-7010-29EB-84940F04016E} = ""%AppData%\Ezuv\evqi.exe""

so that evqi.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Microsoft\Iqdo]
• Eztaux = 13 6B 99 B8 DA 49 5C AE AC 15 57 36 E6 F0 4A 18 2E 22 8F 72 E9 65 67 A5 1E 72 99 4C 56 1C 14 BF 3F AE 30 68 FE BD 13 5F B0 47 2A A9 20 95 70 B2 9B 50 46 F5 6E 28 21 D2 12 4B 37 FD 84 77 0E 21 F7 03 74 A3 FC 28 E6 C9 F7 B1 9A 4A AD 38 14 87 99 09 71 1

• The following Registry Values were modified:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
• 1406 =
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
• 1406 =
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]
• 1406 =
• 1609 =

Other details

• To mark the presence in the system, the following Mutex object was created:
• Local\{6E3B78FF-915E-BDA2-29EB-84940F04016E}

• The following Internet Connections were established:

• The following GET requests were made:
• kings1/data.bin
• pub/adobe/acrobat/js/6.x/rdr/win/enu/DataScript.js