Need help? Ask the community or hire an expert.
Go to Avira Answers
Virus:TR/Spy.ZBot.acr
Date discovered:03/08/2012
Type:Trojan
In the wild:No
Reported Infections:Low to medium
Distribution Potential:Low
Damage Potential:Medium
Static file:No
File size:181.760 Bytes
VDF version:7.11.38.196 - Friday, August 3, 2012
IVDF version:7.11.38.196 - Friday, August 3, 2012

 General Method of propagation:
   • No own spreading routine


Aliases:
   •  Kaspersky: Trojan-Spy.Win32.Zbot.exmv
   •  Eset: Win32/Spy.Zbot.YW
   •  DrWeb: Trojan.PWS.Panda.547


Platforms / OS:
   • Windows XP
   • Windows 2003
   • Windows Vista
   • Windows Server 2008
   • Windows 7


Side effects:
   • Third party control
   • Drops files
   • Registry modification
   • Steals information

 Files  It copies itself to the following location. This file has random bytes appended or changed so it may differ from the original one:
   • %APPDATA%\%random character string%\%random character string%.exe



It creates the following directories:
   • %APPDATA%\%random character string%
   • %APPDATA%\%random character string%



The following files are created:

– %APPDATA%\%random character string%\%random character string%.%random character string% Furthermore it gets executed after it was fully created.
%TEMPDIR%\TMP%number%.bat Furthermore it gets executed after it was fully created. This batch file is used to delete a file.

 Registry The following registry key is added in order to run the process after reboot:

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • "{%generated CLSID%}"="c:\Documents and Settings\Use\Application Data\%random character string%\%random character string%.exe"



It creates the following entry in order to bypass the Windows XP firewall:

– [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
   FirewallPolicy\StandardProfile\AuthorizedApplications\List]
   • %WINDIR%\explorer.exe = %WINDIR%\explorer.exe

 Backdoor Contact server:
All of the following:
   • http://sadawehot.net/e**********g.php
   • http://sadawehot.net/e**********in.php

As a result it may send information and remote control could be provided. This is done via the HTTP POST method using a PHP script.

 Injection – It injects itself as a remote thread into processes.

    All of the following processes:
   • %WINDIR%\Explorer.EXE
   • %SYSDIR%\cmd.exe


 Miscellaneous Mutex:
It creates the following Mutex:
   • %generated CLSID%

Description inserted by Tudor Ciochina on Tuesday, September 25, 2012
Description updated by Tudor Ciochina on Tuesday, September 25, 2012

Back . . . .