Malware Information

Malware name Trojan.Spy.ZBot.dkx Type Trojan Affected platform Win32 Media-Type application/executable MD5 checksum DD2BDDDE963C8F6D5A9F0C0DE6D4457B Static file yes Filesize 56,320 Bytes Alias names (also known as) Sophos Mal/EncPk-CZ McAfee Spy-Agent.bw CA ETrust Win32/Kollah.MT Side effects Downloads a malicious file Registry modification Steals information Third party control Propagation No own spreading routine

Description:

It copies itself to the following location:
• %SYSDIR%\ntos.exe



The following files are created:

– Temporary files that might be deleted afterwards:
• %SYSDIR%\wnspoem\video.dll
• %SYSDIR%\wnspoem\audio.dll




It tries to download a file:

– The location is the following:
• http://alparslanovayurt.com/**********ldr.exe
It is saved on the local hard drive under: %TEMPDIR%\4.tmp Furthermore this file gets executed after it was fully downloaded. Further investigation pointed out that this file is malware, too. Detected as: Trojan.Dldr.Agent.xft


The following registry key is changed:

– [HKLM\software\microsoft\windows nt\currentversion\winlogon]
Old value:
• "userinit"="%SYSDIR%\userinit.exe,"
New value:
• "userinit"="%SYSDIR%\userinit.exe,%SYSDIR%\ntos.exe,"


It doesn't have its own spreading routine but it was spammed out via email. The characteristics are described in the following:


From:
The sender address is spoofed.


Subject:
The following:
• Parcel requires declaration



Body:
The body of the email is the following:

• Good day,

We have received a parcel for you, sent from France on July 9. Please fill out the customs declaration attached to this message and send it to us by mail or fax. The address and the fax number are at the bottom of the declaration form.

Kind regards,
Lucinda Addison
Your Customs Service


Attachment:
The filename of the attachment is:
• Bill_Tax.zip

The attachment is an archive containing a copy of the malware itself.


The following port is opened:

– svchost.exe on a random TCP port


Contact server:
The following:
• http://baltikaredison.ru/**********alaska.bin

As a result it may send information and remote control could be provided.

– It injects the following file into a process: %SYSDIR%\ntos.exe

Process name:
• winlogon.exe



Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.