Need help? Ask the community or hire an expert.
Go to Avira Answers
Virus:TR/Spy.ZBot.aqwe.80
Date discovered:22/03/2010
Type:Trojan
In the wild:Yes
Reported Infections:Low to medium
Distribution Potential:Low to medium
Damage Potential:Low to medium
Static file:Yes
File size:183.808 Bytes
MD5 checksum:d0850ddd5402a66c897b27713fb653f3
IVDF version:7.10.05.162 - Monday, March 22, 2010

 General Method of propagation:
   • Autorun feature


Aliases:
   •  Mcafee: Generic PWS.y
   •  Panda: Trj/Sinowal.WZU
   •  Eset: Win32/Spy.Zbot.JF
   •  Bitdefender: Trojan.Spy.Zbot.EOL


Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows 2003


Side effects:
   • Downloads a malicious file
   • Drops malicious files
   • Registry modification

 Files It copies itself to the following location:
   • %drive%\%executed file%



It copies itself to the following location. This file has random bytes appended so it may differ from the original one:
   • %SYSDIR%\sdra64.exe



The following files are created:

%drive%\Autorun.inf This is a non malicious text file with the following content:
   • %code that runs malware%

%SYSDIR%\lowsec\user.ds
%SYSDIR%\lowsec\local.ds
%SYSDIR%\lowsec\user.ds.lll



It tries to download a file:

– The location is the following:
   • http://sp000.org/SZ/**********

 Registry It creates the following entry in order to bypass the Windows XP firewall:

– [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
   FirewallPolicy\StandardProfile]
   • "EnableFirewall"=dword:0x00000000



The following registry keys are added:

– [HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\
   Protected Storage System Provider\S-1-5-20]
   • "Migrate"=dword:0x00000002

– [HKEY_USERS\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\
   Network]
   • "UID"="%computer name%_7875768FCFF3ECE1"

– [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network]
   • "UID"="%computer name%_7875768FCFF3ECE1"

– [HKEY_USERS\S-1-5-20\Software\Microsoft\
   Protected Storage System Provider\S-1-5-20\Data 2\Windows]
   • "Value"=hex:01,00,00,00,1C,00,00,00,03,00,00,00,CF,7F,87,94,78,98,4B,3A,9F,B5,F1,D3,A7,C2,41,BC,9B,4E,14,16,78,DC,D8,26,10,00,00,00,DB,BA,31,A6,A7,8B,50,80,63,5F,2B,88,9E,BC,52,64,14,00,00,00,80,30,1E,A0,21,18,2F,C4,04,72,C9,C9,5B,F6,9D,88,D5,65,71,F7

– [HKEY_USERS\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\
   Network]
   • "UID"="%computer name%_7875768FCFF3ECE1"

– [HKEY_USERS\.DEFAULT\software\microsoft\windows\currentversion\
   explorer\{4776C4DC-E894-7C06-2148-5D73CEF5F905}]
   • "{3039636B-5F3D-6C64-6675-696870667265}"=hex:F7,09,F2,0D
   • "{33373039-3132-3864-6B30-303233343434}"=hex:F7,09,F2,0D
   • "{6E633338-267E-2A79-6830-386668666866}"=hex:F7,09,F2,0D

– [HKEY_USERS\.DEFAULT\Software\Microsoft\
   Protected Storage System Provider\S-1-5-18\Data 2\Windows]
   • "Value"=hex:01,00,00,00,1C,00,00,00,03,00,00,00,D1,E9,87,19,FA,1F,C2,92,9F,E6,AA,0B,72,F7,6A,EC,43,35,4E,5A,E2,01,17,64,10,00,00,00,E2,96,7F,78,01,CF,44,73,D0,B7,FA,36,F3,AB,D0,7B,14,00,00,00,DF,9D,82,E9,40,7A,0E,0A,5C,04,2F,05,4C,22,73,48,A3,CC,4A,A6

– [HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\
   Protected Storage System Provider\S-1-5-19]
   • "Migrate"=dword:0x00000002

– [HKEY_USERS\.DEFAULT\software\microsoft\windows\currentversion\
   explorer\{43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6}]
   • "{3039636B-5F3D-6C64-6675-696870667265}"=hex:F7,09,F2,0D
   • "{33373039-3132-3864-6B30-303233343434}"=hex:F7,09,F2,0D
   • "{6E633338-267E-2A79-6830-386668666866}"=hex:F7,09,F2,0D

– [HKEY_USERS\S-1-5-19\Software\Microsoft\
   Protected Storage System Provider\S-1-5-19\Data 2\Windows]
   • "Value"=hex:01,00,00,00,1C,00,00,00,03,00,00,00,24,A4,D0,B2,55,2E,BB,96,A2,08,7E,FD,AF,F4,D5,9D,34,F0,A6,6F,A2,AC,20,E7,10,00,00,00,02,D4,18,F6,3D,29,A9,87,D4,3E,30,9D,8B,82,3C,81,14,00,00,00,BC,4C,8A,E7,91,28,24,BE,F4,9E,F6,F9,A9,4F,F8,9E,30,05,10,FC

– [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\
   Protected Storage System Provider\S-1-5-18]
   • "Migrate"=dword:0x00000002

– [HKEY_USERS\.DEFAULT\software\microsoft\windows\currentversion\
   explorer\{3446AF26-B8D7-199B-4CFC-6FD764CA5C9F}]
   • "{3039636B-5F3D-6C64-6675-696870667265}"=hex:F7,09,F2,0D
   • "{33373039-3132-3864-6B30-303233343434}"=hex:F7,09,F2,0D
   • "{6E633338-267E-2A79-6830-386668666866}"=hex:F7,09,F2,0D



The following registry keys are changed:

– [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\
   Winlogon]
   New value:
   • "ParseAutoexec"="1"

– [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
   New value:
   • "userinit"="%SYSDIR%\userinit.exe,%SYSDIR%\sdra64.exe,"

– [HKEY_USERS\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\
   Winlogon]
   New value:
   • "ParseAutoexec"="1"

– [HKEY_USERS\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\
   Winlogon]
   New value:
   • "ParseAutoexec"="1"

 Injection – It injects itself as a remote thread into a process.

    Process name:
   • winlogon.exe



– It injects itself as a remote thread into a process.

    Process name:
   • svchost.exe



– It injects itself as a remote thread into processes.

It is injected into all processes.


 File details Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

Description inserted by Petre Galan on Wednesday, June 16, 2010
Description updated by Petre Galan on Wednesday, June 16, 2010

Back . . . .