Trojan-PSW.Win32.Zbot.4_90d140c73c
HEUR:Trojan.Win32.Generic (Kaspersky), Trojan.Win32.Generic!BT (VIPRE), Trojan-PSW.Win32.Zbot.4.FD, GenericInjector.YR (Lavasoft MAS)
Behaviour: Trojan-PSW, Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
MD5: 90d140c73c50357d965790bac14681b5
SHA1: 60b03588e398a94431c7e785425c4425b5181081
SHA256: f6b5761494ed16289c3b2c895d5cf2a43ea15cfea41af3b61f08ddf24a4c5ab8
SSDeep: 3072:TXWJK kHLsUzJgTraJH3GmQS5lzrKTG20:P SsCaYH7QSJ2y
Size: 130560 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2007-04-18 14:23:51
Summary:
Trojan-PSW. Trojan program intended for stealing users passwords.
Payload
No specific payload has been found.
Process activity
The Trojan-PSW creates the following process(es):
482296.exe:3252
489546.exe:1732
486812.exe:3364
90d140c73c50357d965790bac14681b5.exe:2752
awfap.exe:628
485328.exe:3296
msiexec.exe:3376
The Trojan-PSW injects its code into the following process(es):
ctfmon.exe:252
File activity
The process 482296.exe:3252 makes changes in a file system.
The Trojan-PSW creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\WEA4327.bat (175 bytes)
%Documents and Settings%\%current user%\Application Data\Aduxr\awfap.exe (1742 bytes)
The process ctfmon.exe:252 makes changes in a file system.
The Trojan-PSW creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\ntuser.dat.LOG (4512 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (4108 bytes)
The process 489546.exe:1732 makes changes in a file system.
The Trojan-PSW creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\QMZ74C4.bat (175 bytes)
The process 486812.exe:3364 makes changes in a file system.
The Trojan-PSW creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\ZMMB534.bat (175 bytes)
The process 90d140c73c50357d965790bac14681b5.exe:2752 makes changes in a file system.
The Trojan-PSW creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\485328.exe (682128 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\489546.exe (1229760 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\482296.exe (1229760 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\508562.bat (94 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\486812.exe (1229760 bytes)
The process awfap.exe:628 makes changes in a file system.
The Trojan-PSW creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\ntuser.dat.LOG (8320 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (7708 bytes)
The process msiexec.exe:3376 makes changes in a file system.
The Trojan-PSW creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D (200 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D (1 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\8A574ED5927B3CEC9626151D220C7448 (160 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\D4F348B882DF3F205ECCB6243795CB3A (554 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\D4F348B882DF3F205ECCB6243795CB3A (200 bytes)
%Documents and Settings%\%current user%\Cookies\GDPFE9XJ.txt (541 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\8A574ED5927B3CEC9626151D220C7448 (664 bytes)
The Trojan-PSW deletes the following file(s):
%Documents and Settings%\%current user%\Cookies\3QE1QHRN.txt (0 bytes)
Registry activity
The process 482296.exe:3252 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A5 0C 66 16 3F E3 8C E3 DB F3 15 40 23 79 7C 9B"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
The process ctfmon.exe:252 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BE 28 6E A7 56 CE D0 FA EF 16 AC 5C 4F CC A0 34"
[HKCU\Identities]
"Last User ID" = "{6855BFC2-9E4A-4896-A11D-74388FBABDC2}"
[HKCU\Identities]
"Last Username" = "Main Identity"
[HKCU\Software\Microsoft\WAB\WAB4]
"OlkFolderRefresh" = "0"
[HKCU\Software\Microsoft\WAB\WAB4]
"FirstRun" = "1"
[HKCU\Software\Microsoft\Etusoqy]
"1g05j7dj" = "2523554133"
[HKCU\Identities]
"Identity Login" = "622675"
[HKCU\Software\Microsoft\Internet Account Manager]
"Server ID" = "4"
[HKCU\Identities]
"Identity Ordinal" = "2"
[HKCU\Software\Microsoft\WAB\WAB4]
"OlkContactRefresh" = "0"
The Trojan-PSW deletes the following value(s) in system registry:
[HKCU\Identities]
"Changing"
[HKCU\Identities]
"OutgoingID"
[HKCU\Identities]
"IncomingID"
The Trojan-PSW disables automatic startup of the application by deleting the following autorun value:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"internat.exe"
The process 489546.exe:1732 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0D ED 3D 7F 47 3A 63 CA 80 F3 C8 B0 68 01 51 08"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
The process 486812.exe:3364 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "00 7F D5 26 76 90 27 A6 80 04 F7 46 AE 39 49 16"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
The process 90d140c73c50357d965790bac14681b5.exe:2752 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f3-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKU\S-1-5-21-796845957-1563985344-1801674531-500\Software\WinRAR]
"Client Hash" = "24 FB 5E 72 B3 86 4B 27 CB BF FA D9 2B 9D 9B C1"
[HKCU\Software\WinRAR]
"0805CB583A4E5478AD02B95B4FFFD813" = "74 72 75 65"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\WinRAR]
"Client Hash" = "35 75 EF B1 FF 19 94 0F C4 FA 61 CA 7B CD 9F 68"
[HKU\S-1-5-21-796845957-1563985344-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\Administrator\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKU\S-1-5-21-796845957-1563985344-1801674531-500\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"ParseAutoexec" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"508562.bat" = "508562"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"489546.exe" = "489546"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"485328.exe" = ""
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f2-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"
[HKU\S-1-5-21-796845957-1563985344-1801674531-500\Software\WinRAR]
"HWID" = "7B 30 45 42 39 38 43 32 44 2D 37 42 42 32 2D 34"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"482296.exe" = "482296"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8E 3D 6F 75 5A 14 EC 5B CE CA 31 64 3A 07 A6 0D"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{773a730e-74fb-11e2-b597-000c293bdf2f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"486812.exe" = "486812"
[HKU\S-1-5-21-796845957-1563985344-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\Administrator\Local Settings\Application Data"
[HKU\S-1-5-21-796845957-1563985344-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\Administrator\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f5-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\WinRAR]
"HWID" = "7B 44 41 46 43 36 35 33 43 2D 43 32 30 32 2D 34"
[HKCU\Software\WinRAR]
"493C8DE9961A4B8A33DCAD57041254AE" = "74 72 75 65"
The Trojan-PSW modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan-PSW modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
The Trojan-PSW modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The process awfap.exe:628 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "39 2E C2 51 72 E9 FA E0 50 9A 68 E4 7C A0 0E 1F"
[HKCU\Software\Microsoft\Etusoqy]
"20h13gi1" = "d2EClh4sReAawM3AqDE=#"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
The process 485328.exe:3296 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0F B6 6E 88 66 C3 66 50 9A F0 FC 8D 6B 98 1C 93"
The process msiexec.exe:3376 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "62 90 AA 63 F9 7F 6C 9B 63 CE 5F 7F 9F DF 3F 03"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 40 00 00 00 01 00 00 00 00 00 00 00"
The Trojan-PSW modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
The Trojan-PSW modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan-PSW modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan-PSW deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
Network activity (URLs)
| URL | IP |
|---|---|
| hxxp://www3.l.google.com/GIAG2.crl |  |
| hxxp://78.140.131.151/uploading/id=814807601&u=4WaevjA sJYcZzvAmxr5vGGkeId zzU/S3vSnhLbacviRtnYIg2xc6QMAWYaZM4RqxalcusDRHEAXzrrfOX1zQ== |  |
| hxxp://69.163.37.234/forum/viewtopic.php | |
| pki.google.com | 74.125.225.39 |
| cdn147.servinguploadetc.com |  78.131.140.151 |
Rootkit activity
The Trojan-PSW installs the following user-mode hooks in WININET.dll:
HttpSendRequestExW
HttpSendRequestExA
InternetWriteFile
InternetReadFileExA
InternetReadFileExW
HttpSendRequestA
HttpSendRequestW
InternetQueryDataAvailable
HttpQueryInfoW
InternetCloseHandle
HttpQueryInfoA
InternetReadFile
The Trojan-PSW installs the following user-mode hooks in CRYPT32.dll:
PFXImportCertStore
The Trojan-PSW installs the following user-mode hooks in USER32.dll:
GetClipboardData
TranslateMessage
The Trojan-PSW installs the following user-mode hooks in Secur32.dll:
UnsealMessage
SealMessage
DeleteSecurityContext
The Trojan-PSW installs the following user-mode hooks in WS2_32.dll:
WSAGetOverlappedResult
WSASend
recv
gethostbyname
WSARecv
send
closesocket
freeaddrinfo
getaddrinfo
GetAddrInfoW
The Trojan-PSW installs the following user-mode hooks in ntdll.dll:
LdrLoadDll
NtCreateThread
Propagation
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Scan a system with an anti-rootkit tool.
- Terminate malicious process(es) (How to End a Process With the Task Manager):
482296.exe:3252
489546.exe:1732
486812.exe:3364
90d140c73c50357d965790bac14681b5.exe:2752
awfap.exe:628
485328.exe:3296 - Delete the original Trojan-PSW file.
- Delete or disinfect the following files created/modified by the Trojan-PSW:
%Documents and Settings%\%current user%\Local Settings\Temp\WEA4327.bat (175 bytes)
%Documents and Settings%\%current user%\Application Data\Aduxr\awfap.exe (1742 bytes)
%Documents and Settings%\%current user%\ntuser.dat.LOG (4512 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (4108 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QMZ74C4.bat (175 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZMMB534.bat (175 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\485328.exe (682128 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\489546.exe (1229760 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\482296.exe (1229760 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\508562.bat (94 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\486812.exe (1229760 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D (200 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D (1 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\8A574ED5927B3CEC9626151D220C7448 (160 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\D4F348B882DF3F205ECCB6243795CB3A (554 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\D4F348B882DF3F205ECCB6243795CB3A (200 bytes)
%Documents and Settings%\%current user%\Cookies\GDPFE9XJ.txt (541 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\8A574ED5927B3CEC9626151D220C7448 (664 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
