Virus:TR/Spy.ZBot.ajje
Date discovered:17/05/2010
Type:Trojan
In the wild:Yes
Reported Infections:Low to medium
Distribution Potential:Low to medium
Damage Potential:Medium
Static file:Yes
File size:97.792 Bytes
MD5 checksum:45220f9845f2479b394e95bd2d83fe7a
IVDF version:7.10.07.115 - Monday, May 17, 2010

 General Methods of propagation:
   • Autorun feature
   • Local network


Aliases:
   •  Bitdefender: Trojan.Generic.KD.11856
   •  Panda: Trj/Sinowal.XDY
   •  Eset: Win32/Spy.Zbot.UN


Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows 2003


Side effects:
   • Downloads a malicious file
   • Drops malicious files
   • Registry modification

 Files It copies itself to the following locations:
   • %SYSDIR%\sdra64.exe
   • %drive%\%executed file%



The following files are created:

– %drive%\Autorun.inf This is a non malicious text file with the following content:
   • %code that runs malware%

– %SYSDIR%\lowsec\user.ds
– %SYSDIR%\lowsec\local.ds
– %SYSDIR%\lowsec\user.ds.lll



It tries to download a file:

– The location is the following:
   • http://wmbarnaul.info/4/**********

 Registry It creates the following entry in order to bypass the Windows XP firewall:



The following registry keys are added:

– [HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\
   Protected Storage System Provider\S-1-5-20]
   • "Migrate"=dword:0x00000002

– [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network]
   • "UID"="%computer name%_00072ECE"

– [HKEY_USERS\S-1-5-20\Software\Microsoft\
   Protected Storage System Provider\S-1-5-20\Data 2\Windows]
   • "Value"=hex:01,00,00,00,1C,00,00,00,03,00,00,00,13,D2,BB,5E,17,BB,34,D5,40,23,43,D0,24,22,E3,74,72,44,D8,45,D4,20,CD,DB,10,00,00,00,DB,BA,31,A6,A7,8B,50,80,63,5F,2B,88,9E,BC,52,64,14,00,00,00,80,30,1E,A0,21,18,2F,C4,04,72,C9,C9,5B,F6,9D,88,D5,65,71,F7

– [HKEY_USERS\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\
   Network]
   • "UID"="%computer name%_00079335"

– [HKEY_USERS\.DEFAULT\software\microsoft\windows\currentversion\
   explorer\{35106240-D2F0-DB35-716E-127EB80A0299}]
   • "{3039636B-5F3D-6C64-6675-696870667265}"=hex:F7,09,F2,0D
   • "{33373039-3132-3864-6B30-303233343434}"=hex:47,09,F2,0D

– [HKEY_USERS\.DEFAULT\Software\Microsoft\
   Protected Storage System Provider\S-1-5-18\Data 2\Windows]
   • "Value"=hex:01,00,00,00,1C,00,00,00,03,00,00,00,81,19,B9,9D,0C,F8,BA,0A,1E,92,06,E1,97,47,46,6A,ED,17,AA,C4,3C,58,F3,78,10,00,00,00,E2,96,7F,78,01,CF,44,73,D0,B7,FA,36,F3,AB,D0,7B,14,00,00,00,DF,9D,82,E9,40,7A,0E,0A,5C,04,2F,05,4C,22,73,48,A3,CC,4A,A6

– [HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\
   Protected Storage System Provider\S-1-5-19]
   • "Migrate"=dword:0x00000002

– [HKEY_USERS\.DEFAULT\software\microsoft\windows\currentversion\
   explorer\{43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6}]
   • "{3039636B-5F3D-6C64-6675-696870667265}"=hex:F7,09,F2,0D
   • "{33373039-3132-3864-6B30-303233343434}"=hex:47,09,F2,0D

– [HKEY_USERS\S-1-5-19\Software\Microsoft\
   Protected Storage System Provider\S-1-5-19\Data 2\Windows]
   • "Value"=hex:01,00,00,00,1C,00,00,00,03,00,00,00,F5,5F,18,F4,3A,29,1B,91,76,EB,5A,A9,84,B4,30,7A,23,B1,3A,9D,4A,2A,08,6C,10,00,00,00,6C,8C,A9,0F,A7,7D,7B,C2,59,5F,62,9C,3F,E3,18,7A,14,00,00,00,AD,02,2E,92,33,6D,10,51,9F,2E,81,05,10,5E,97,C8,D1,5D,3C,33

– [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\
   Protected Storage System Provider\S-1-5-18]
   • "Migrate"=dword:0x00000002

– [HKEY_USERS\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\
   Network]
   • "UID"="%computer name%_00077184"



The following registry keys are changed:

– [HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main]
   New value:
   • "Start Page"=""

– [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
   New value:
   • "userinit"="%SYSDIR%\userinit.exe,%SYSDIR%\sdra64.exe,"

– [HKEY_USERS\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\
   Winlogon]
   New value:
   • "ParseAutoexec"="1"

– [HKEY_USERS\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\
   Winlogon]
   New value:
   • "ParseAutoexec"="1"

– [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\
   Winlogon]
   New value:
   • "ParseAutoexec"="1"

– [HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main]
   New value:
   • "Start Page"=""

 Network Infection In order to ensure its propagation the malware attemps to connect to other machines as described below.


Exploit:
It makes use of the following Exploit:
– MS04-007 (ASN.1 Vulnerability)

 Stealing It tries to steal the following information:
– Passwords typed into 'password input fields'

– A logging routine is started after a website is visited:
   • https://onlineeast.bankofamerica.com/cgi-bin/ias/*/GotoWelcome

 Injection – It injects itself as a remote thread into a process.

    Process name:
   • winlogon.exe



– It injects itself as a remote thread into a process.

    Process name:
   • svchost.exe



– It injects itself as a remote thread into a process.

It is injected into all processes.


 File details Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

Description inserted by Petre Galan on Wednesday, September 29, 2010
Description updated by Andrei Ivanes on Friday, October 1, 2010

Back . . . .
 
 
 
 

© 2013 Avira Operations GmbH & Co. KG. All rights reserved.

My Account

https:// This window is encrypted for your security.