Submission Summary:

• Submission details:
• Submission received: 22 October 2012, 22:47:19
• Processing time: 10 min 53 sec
• Submitted sample:
• File MD5: 0xE15FE77DF4FA275604BD5035744505AC
• File SHA-1: 0xB3D4666E56E433DB25904DAD8C8B334CF453C058
• Filesize: 575,073 bytes
• Alias:
• Trojan-Spy.Win32.Zbot.bopd [Kaspersky Lab]
• Trojan-Spy.Win32.Zbot [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AppData%\Necu\asry.exe	141,312 bytes	MD5: 0x0271D3F58B29251B756238E1E60EB335 SHA-1: 0x5747E5A6EC851CB91C2A28ECC82489B315B2180F	Trojan.Zbot!gen19 [Symantec] Trojan-Spy.Win32.Zbot.bopd [Kaspersky Lab] PWS-Zbot.gen.ds [McAfee] Troj/PWS-BSF [Sophos] PWS:Win32/Zbot.gen!Y [Microsoft] Trojan-Spy.Win32.Zbot [Ikarus]
2	%AppData%\Quadxa\ifzue.mui	1,277 bytes	MD5: 0x7A6C1FC14A1C823AEDFFBB87DB30426B SHA-1: 0x2ED0BD7DB5612DA84AD711C386AF1203C35B7492	(not available)
3	%AppData%\Quadxa\ifzue.tmp	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)
4	%Temp%\ckz_0I3Q\tt.bat	71 bytes	MD5: 0xAA380F64D9DB287A7EF44B8C8706486F SHA-1: 0x2F13AD0FC72868C8C44AD19E64DA7F25915EA0BC	(not available)
5	%Temp%\ckz_0I3Q\tt.pdf	9,283 bytes	MD5: 0xCAABACF7A86F357BD3C92FE6E7DBB95A SHA-1: 0xF1137B5EA249AE17551C3CB065CFAB7FAAA06193	(not available)
6	[file and pathname of the sample #1]	575,073 bytes	MD5: 0xE15FE77DF4FA275604BD5035744505AC SHA-1: 0xB3D4666E56E433DB25904DAD8C8B334CF453C058	Trojan-Spy.Win32.Zbot.bopd [Kaspersky Lab] Trojan-Spy.Win32.Zbot [Ikarus]

• Notes:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

• The following directories were created:
• %AppData%\Necu
• %AppData%\Quadxa
• %Temp%\ckz_0I3Q

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
asry.exe	%AppData%\Necu\asry.exe	159,744 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	495,616 bytes
tt.exe	%Temp%\ckz_0I3Q\tt.exe	159,744 bytes

Registry Modifications

• The following Registry Keys were created:
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy
• HKEY_CURRENT_USER\Software\Microsoft\Atuw

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Identities]
• Identity Login = 0x00098053
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy]
• CleanCookies = 0x00000000
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• {BF16103E-762A-1838-8A2F-673F10ED64CA} = ""%AppData%\Necu\asry.exe""

so that asry.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Microsoft\Atuw]
• Arunenep = 0F 45 8E B2 E3 87 F5 3B FF 67 09 4C 4A 8F 92 9C 2E E9 DC E6 8E C1 93 35 7B AF 5B FE BF 91 5E 8B 55 7F 06 25 14 EB 91 11 49 B5 6F 1A E7 7A DE 5F F5 D9 2B 05 85 39 E3 48 CE E9 5F 45 56 8F 88 69 39 27 22 F7 04 76 65 F7 2D 68 B2 E1 D8 3A 43 E4 88 21 CA B

• The following Registry Values were modified:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
• 1406 =
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
• 1406 =
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]
• 1406 =
• 1609 =

Other details

• To mark the presence in the system, the following Mutex object was created:
• Local\{72A40927-6F33-D58A-8A2F-673F10ED64CA}

• The following Internet Connections were established:

• The following GET requests were made:
• brud1/data.bin
• pub/adobe/acrobat/js/6.x/rdr/win/enu/DataScript.js