Malware Information

Malware name Trojan.Spy.ZBot.DPE Type Trojan Affected platform Win32 Media-Type application/executable MD5 checksum 606AB42E4C906F933BC9C5AB62B798D9 Static file yes Filesize 59,904 Bytes Alias names (also known as) Sophos Troj/Agent-HJG McAfee Spy-Agent.bw CA ETrust Win32/Kollah.NC Side effects Downloads a malicious file Registry modification Steals information Third party control Propagation No own spreading routine

Description:

It copies itself to the following location:
• %SYSDIR%\ntos.exe



The following files are created:

– Temporary files that might be deleted afterwards:
• %SYSDIR%\wnspoem\video.dll
• %SYSDIR%\wnspoem\audio.dll




It tries to download a file:

– The location is the following:
• http://dr-mahmoud.com/**********.exe
It is saved on the local hard drive under: %TEMPDIR%\1.tmp Furthermore this file gets executed after it was fully downloaded. Further investigation pointed out that this file is malware, too. Detected as: 4026


The following registry key is changed:

– [HKLM\software\microsoft\windows nt\currentversion\winlogon]
Old value:
• "userinit"="%SYSDIR%\userinit.exe,"
New value:
• "userinit"="%SYSDIR%\userinit.exe,%SYSDIR%\ntos.exe,"


It doesn't have its own spreading routine but it was spammed out via email. The characteristics are described in the following:


From:
The sender address is spoofed.


Subject:
The following:
• Rechnung N%number%

The body of the email is one of the following:

• Sehr geehre Damen und Herren,
Ihr Auftrag Nr. SP7848895 wurde erfullt.
Ein Betrag von 6536.02 EURO wurde abgebucht und wird in Ihrem Bankauszug als “Paypalabbuchung ” angezeigt.
Sie finden die Details zu der Rechnung im Anhang

PayPal (Europe)
S.158; r.l. & Cie, S.C.A.
50-40 Boulevard Royal
L-7672 Luxembourg

Hochachtungsvoll,
Vertretungsberechtigter: Armand Kruse
Handelsregisternummer: R.C.S. B 285 380


• Sehr geehrte Kunden,
Ihr Auftrag Nr. SP8742024 wurde erfullt.
Ein Betrag von 6127.53 EURO wurde abgebucht und wird in Ihrem Bankauszug als "Paypalabbuchung " angezeigt.
Sie finden die Details zu der Rechnung im Anhang

PayPal (Europe)
S.392; r.l. & Cie, S.C.A.
63-88 Boulevard Royal
L-2082 Luxembourg

Mit freundlichen Grussen,
Vertretungsberechtigter: Joanna Muller
Handelsregisternummer: R.C.S. B 922 819



Attachment:
The filename of the attachment is:
• REC719271.zip

The attachment is an archive containing a copy of the malware itself.



The email looks like the following:



The following port is opened:

– svchost.exe on a random TCP port


Contact server:
The following:
• http://ahleinaks.ru/**********/millionertest.bin

As a result it may send information and remote control could be provided.

– It injects the following file into a process: %SYSDIR%\ntos.exe

Process name:
• winlogon.exe



Programming language:
The malware program was written in MS Visual C++.


Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.