Need help? Ask the community or hire an expert.
Go to Avira Answers
Virus:TR/Spy.ZBot.ajns
Date discovered:23/05/2010
Type:Trojan
In the wild:Yes
Reported Infections:Low to medium
Distribution Potential:Low to medium
Damage Potential:Low to medium
Static file:Yes
File size:128.512 Bytes
MD5 checksum:eb51e23d51fce38ecdaed1d978073b2f
IVDF version:7.10.07.162 - Sunday, May 23, 2010

 General Method of propagation:
   • Autorun feature


Aliases:
   •  Bitdefender: Trojan.Spy.Zbot.EPX
   •  Panda: Trj/Sinowal.XDY
   •  Eset: Win32/Spy.Zbot.YW


Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows 2003


Side effects:
   • Drops malicious files
   • Registry modification

 Files It copies itself to the following locations:
   • %SYSDIR%\sdra64.exe
   • %drive%\%executed file%



The following files are created:

%drive%\Autorun.inf This is a non malicious text file with the following content:
   • %code that runs malware%

%SYSDIR%\lowsec\user.ds
%SYSDIR%\lowsec\local.ds
%SYSDIR%\lowsec\user.ds.lll

 Registry The following registry keys are added:

– [HKEY_USERS\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\
   Network]
   • "UID"="VX-C701DE77A7A5_B4DF7611C4BED220"

– [HKEY_USERS\.DEFAULT\Software\Microsoft\
   Protected Storage System Provider\S-1-5-18\Data 2\Windows]
   • "Value"=hex:01,00,00,00,1C,00,00,00,03,00,00,00,97,90,0B,42,5D,14,AF,03,AE,21,B5,67,0B,73,6A,12,19,F5,9F,61,66,72,2B,B2,10,00,00,00,2F,1F,10,5B,CD,FF,BF,5C,FD,24,74,F9,CC,F0,D6,6A,14,00,00,00,2F,23,63,C6,92,60,90,62,ED,78,96,40,22,CF,D4,DD,FD,52,88,1E

– [HKCU\Software\Microsoft]
   • "@"=dword:0x00000001

– [HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\
   Protected Storage System Provider\S-1-5-19]
   • "Migrate"=dword:0x00000002

– [HKEY_USERS\.DEFAULT\software\microsoft\windows\currentversion\
   explorer\{43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6}]
   • "{3039636B-5F3D-6C64-6675-696870667265}"=hex:F7,09,F2,0D
   • "{33373039-3132-3864-6B30-303233343434}"=hex:F7,09,F2,0D
   • "{6E633338-267E-2A79-6830-386668666866}"=hex:F7,09,F2,0D

– [HKEY_USERS\S-1-5-19\Software\Microsoft\
   Protected Storage System Provider\S-1-5-19\Data 2\Windows]
   • "Value"=hex:01,00,00,00,1C,00,00,00,03,00,00,00,75,3D,AE,D8,D9,8E,E6,31,65,99,49,A8,70,C8,0D,EB,09,02,38,77,47,66,AA,28,10,00,00,00,5B,76,73,0F,51,A9,51,31,8C,1F,1A,55,3B,53,5B,C0,14,00,00,00,6B,61,41,FB,40,DE,9E,C7,92,BD,57,66,11,42,B0,42,21,C5,89,88

– [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\
   Protected Storage System Provider\S-1-5-18]
   • "Migrate"=dword:0x00000002

– [HKEY_USERS\.DEFAULT\software\microsoft\windows\currentversion\
   explorer\{3446AF26-B8D7-199B-4CFC-6FD764CA5C9F}]
   • "{3039636B-5F3D-6C64-6675-696870667265}"=hex:F7,09,F2,0D
   • "{33373039-3132-3864-6B30-303233343434}"=hex:F7,09,F2,0D
   • "{6E633338-267E-2A79-6830-386668666866}"=hex:F7,09,F2,0D

– [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network]
   • "UID"="VX-C701DE77A7A5_B4DF7611C4BED220"

– [HKEY_USERS\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\
   Network]
   • "UID"="VX-C701DE77A7A5_B4DF7611C4BED220"



The following registry keys are changed:

– [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\
   Winlogon]
   New value:
   • "ParseAutoexec"="1"

– [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
   New value:
   • "userinit"="%SYSDIR%\userinit.exe,%SYSDIR%\sdra64.exe,"

– [HKEY_USERS\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\
   Winlogon]
   New value:
   • "ParseAutoexec"="1"

 Network Infection Exploit:
It makes use of the following Exploit:
– MS04-007 (ASN.1 Vulnerability)

 Stealing – A logging routine is started after a website is visited:
   • https://onlineeast.bankofamerica.com/cgi-bin/ias/*/GotoWelcome

 Injection – It injects itself as a remote thread into a process.

    Process name:
   • winlogon.exe



– It injects itself as a remote thread into a process.

    Process name:
   • svchost.exe



– It injects itself as a remote thread into a process.

It is injected into all processes.


 File details Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

Description inserted by Petre Galan on Thursday, September 30, 2010
Description updated by Andrei Ivanes on Friday, October 1, 2010

Back . . . .