Skip to main content

TrojanPSW.Win32.Zbot.4_a7f002f83b


Trojan.GenericKD.1523786 (BitDefender), VirTool:Win32/CeeInject (Microsoft), Trojan-Spy.Win32.Zbot.rjkp (Kaspersky), Trojan.Win32.Generic!BT (VIPRE), Trojan.PWS.Panda.5676 (DrWeb), Trojan.GenericKD.1523786 (B) (Emsisoft), Dowloader-FEX (McAfee), WS.Reputation.1 (Symantec), Virus.Win32.CeeInject (Ikarus), Trojan.GenericKD.1523786 (FSecure), Generic35.BNME (AVG), Win32:Zbot-SNH [Trj] (Avast), TSPY_ZBOT.YZC (TrendMicro), Trojan.GenericKD.1523786 (AdAware), Trojan-PSW.Win32.Zbot.4.FD, GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan-Spy, Trojan-PSW, Trojan, Virus, VirTool

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: a7f002f83b383ddc2bc3b615a83f2405

SHA1: 582046e3c2c324e1a7dafec6098f22a537395c98

SHA256: 655f5b0d15887fda58813eb9ac4f54874b0e926d36f587ad044b0da496b2968b

SSDeep: 6144:kA6ohswcrej/cc8uOQFeE8y3jDDfL T0AVGgHJ90sTs/cyMAqHozEjRD9:kA6oGwseTHTFe2jffST04GAS Uc62R

Size: 332601 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: QuickSet

Created at: 2014-01-20 20:42:54

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan-PSW. Trojan program intended for stealing users passwords.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan-PSW creates the following process(es):

%original file name%.exe:460
%original file name%.exe:456
aqhy.exe:2008
aqhy.exe:240

The Trojan-PSW injects its code into the following process(es):

Explorer.EXE:692

File activity

The process %original file name%.exe:460 makes changes in the file system.


The Trojan-PSW creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Xizose\aqhy.exe (2437 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DCR3760.bat (173 bytes)

The process %original file name%.exe:456 makes changes in the file system.


The Trojan-PSW creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Start Menu\Programs\Startup\system.pif (2105 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Startup\system.pif (2105 bytes)
%Documents and Settings%\%current user%\Application Data\InstallDir\help.exe (2105 bytes)

The process aqhy.exe:2008 makes changes in the file system.


The Trojan-PSW creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Start Menu\Programs\Startup\system.pif (2105 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Startup\system.pif (2105 bytes)
%Documents and Settings%\%current user%\Application Data\InstallDir\help.exe (2105 bytes)

The process aqhy.exe:240 makes changes in the file system.


The Trojan-PSW creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\NTUSER.DAT.LOG (8472 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (5236 bytes)

Registry activity

The process %original file name%.exe:460 makes changes in the system registry.


The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "12 A7 A3 74 95 3E 66 32 7A 15 D5 23 44 97 7F A8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process %original file name%.exe:456 makes changes in the system registry.


The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "37 86 FD 16 83 C8 C6 E6 B6 3A 25 09 07 27 15 33"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

To automatically run itself each time Windows is booted, the Trojan-PSW adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"help" = "%Documents and Settings%\%current user%\Application Data\InstallDir\help.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"help" = "%Documents and Settings%\%current user%\Application Data\InstallDir\help.exe"

The process aqhy.exe:2008 makes changes in the system registry.


The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "07 75 E7 55 CF EF 9E 36 15 86 A3 CB CA FB 7C 69"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

To automatically run itself each time Windows is booted, the Trojan-PSW adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"help" = "%Documents and Settings%\%current user%\Application Data\InstallDir\help.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"help" = "%Documents and Settings%\%current user%\Application Data\InstallDir\help.exe"

The process aqhy.exe:240 makes changes in the system registry.


The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EC 92 66 1D CA 38 5A 44 48 A7 64 42 BD 54 E6 15"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Microsoft\Ydkaosywbor]
"2e38jeei" = "ELI/s1EkoE6/HO nNag=\"

Dropped PE files

MD5 File path
aacb4cd12f9c2fd28ddad364c2e9e7dcc:\Documents and Settings\All Users\Start Menu\Programs\Startup\system.pif
aacb4cd12f9c2fd28ddad364c2e9e7dcc:\Documents and Settings\"%CurrentUserName%"\Application Data\InstallDir\help.exe
aacb4cd12f9c2fd28ddad364c2e9e7dcc:\Documents and Settings\"%CurrentUserName%"\Application Data\Xizose\aqhy.exe
aacb4cd12f9c2fd28ddad364c2e9e7dcc:\Documents and Settings\"%CurrentUserName%"\Start Menu\Programs\Startup\system.pif

HOSTS file anomalies

No changes have been detected.

Rootkit activity

The Trojan-PSW installs the following user-mode hooks in WININET.dll:

HttpSendRequestExA
HttpSendRequestW
InternetReadFileExA
InternetWriteFile
InternetWriteFileExA
InternetQueryDataAvailable
HttpQueryInfoW
HttpSendRequestExW
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
InternetCloseHandle

The Trojan-PSW installs the following user-mode hooks in CRYPT32.dll:

PFXImportCertStore

The Trojan-PSW installs the following user-mode hooks in USER32.dll:

GetClipboardData
TranslateMessage

The Trojan-PSW installs the following user-mode hooks in Secur32.dll:

DecryptMessage
SealMessage
DeleteSecurityContext

The Trojan-PSW installs the following user-mode hooks in WS2_32.dll:

WSAGetOverlappedResult
WSASend
recv
gethostbyname
WSARecv
send
closesocket
freeaddrinfo
getaddrinfo
GetAddrInfoW

The Trojan-PSW installs the following user-mode hooks in ntdll.dll:

LdrLoadDll
NtCreateThread

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Scan a system with an anti-rootkit tool.
  2. Terminate malicious process(es) (How to End a Process With the Task Manager):

    %original file name%.exe:460
    %original file name%.exe:456
    aqhy.exe:2008
    aqhy.exe:240

  3. Delete the original Trojan-PSW file.
  4. Delete or disinfect the following files created/modified by the Trojan-PSW:

    %Documents and Settings%\%current user%\Application Data\Xizose\aqhy.exe (2437 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\DCR3760.bat (173 bytes)
    %Documents and Settings%\%current user%\Start Menu\Programs\Startup\system.pif (2105 bytes)
    %Documents and Settings%\All Users\Start Menu\Programs\Startup\system.pif (2105 bytes)
    %Documents and Settings%\%current user%\Application Data\InstallDir\help.exe (2105 bytes)
    %Documents and Settings%\%current user%\NTUSER.DAT.LOG (8472 bytes)

  5. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "help" = "%Documents and Settings%\%current user%\Application Data\InstallDir\help.exe"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "help" = "%Documents and Settings%\%current user%\Application Data\InstallDir\help.exe"

  6. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text40966509112643.81936cfd2f3ae33eaf50f94f71dd77d0b0091
.rdata12288223225602.471063f016c482b292a47739473952e30474e
.data1638428425121.157487198995bdcb8f14f354dff4d6d9ab829
.idata20480247030723.41138b03bee24e3daaddaf1e6f1dae7f9cdb7

rsrc

24576885692162.5325e38cb18c067a5897d139c54a5610f3c0.rsrc3686412260122883.07296946aabf7851d3160878d411047d6390c

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:


Total found: 1
f04d2b1200fd2194f25e433ad9e0e33a

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

Strings from Dumps

Explorer.EXE_692_rwx_01EA0000_00048000:

.text

.text

`.data

`.data

.idata

.idata

@.reloc

@.reloc

Invalid parameter passed to C runtime function.

Invalid parameter passed to C runtime function.

>$>,>4><>

>$>,>4><>

0123456789

0123456789

http://www.google.com/

http://www.google.com/

http://www.bing.com/

http://www.bing.com/

REPORT

REPORT

HTTP/1.1

HTTP/1.1

RegDeleteKeyExW

RegDeleteKeyExW

gdiplus.dll

gdiplus.dll

GdiplusShutdown

GdiplusShutdown

.TJFZAIY]JD^"

.TJFZAIY]JD^"

?:527|:!;8

?:527|:!;8

!1 (##!(

!1 (##!(

Kmv`jn`%fnfnzg,bt3crd~da4

Kmv`jn`%fnfnzg,bt3crd~da4

1&,$=OJ-:&#O-

1&,$=OJ-:&#O-

-.ynp<</pre><pre>'2$4>%|903</pre><pre>: 8? 1 !</pre><pre>userenv.dll</pre><pre>del "%s"</pre><pre>if exist "%s" goto d</pre><pre>del /F "%s"</pre><pre>w%fkN</pre><pre>t.Ht$HHt</pre><pre>L$$</pre><pre>m9.td</pre><pre>zcÁ</pre><pre>ntdll.dll</pre><pre>KERNEL32.dll</pre><pre>ExitWindowsEx</pre><pre>GetKeyboardState</pre><pre>MsgWaitForMultipleObjects</pre><pre>USER32.dll</pre><pre>CryptGetKeyParam</pre><pre>CryptImportKey</pre><pre>CryptDestroyKey</pre><pre>RegCreateKeyExW</pre><pre>RegCloseKey</pre><pre>RegQueryInfoKeyW</pre><pre>RegDeleteKeyW</pre><pre>RegOpenKeyExW</pre><pre>RegFlushKey</pre><pre>RegEnumKeyExW</pre><pre>ADVAPI32.dll</pre><pre>UrlUnescapeA</pre><pre>PathIsURLW</pre><pre>SHLWAPI.dll</pre><pre>ShellExecuteW</pre><pre>SHELL32.dll</pre><pre>Secur32.dll</pre><pre>ole32.dll</pre><pre>GDI32.dll</pre><pre>WS2_32.dll</pre><pre>CertDeleteCertificateFromStore</pre><pre>CertOpenSystemStoreW</pre><pre>CertCloseStore</pre><pre>CertEnumCertificatesInStore</pre><pre>CertDuplicateCertificateContext</pre><pre>PFXExportCertStoreEx</pre><pre>PFXImportCertStore</pre><pre>CRYPT32.dll</pre><pre>HttpSendRequestExA</pre><pre>HttpQueryInfoA</pre><pre>InternetCrackUrlA</pre><pre>HttpOpenRequestA</pre><pre>HttpEndRequestA</pre><pre>HttpAddRequestHeadersA</pre><pre>WININET.dll</pre><pre>OLEAUT32.dll</pre><pre>NETAPI32.dll</pre><pre>IPHLPAPI.DLL</pre><pre>VERSION.dll</pre><pre>msvcrt.dll</pre><pre>9 9$9(9,9094989</pre><pre>> >$>(>,>0>4>|></pre><pre>00D0K0_0q0z0</pre><pre>:!:(:,:1:8:^:</pre><pre>\StringFileInfo\xx\%s</pre><pre>urlmon.dll</pre><pre>SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\%s</pre><pre>kernel32.dll</pre><pre>launchpadshell.exe</pre><pre>dirclt32.exe</pre><pre>wtng.exe</pre><pre>prologue.exe</pre><pre>pcsws.exe</pre><pre>fdmaster.exe</pre><pre>shell32.dll</pre><pre>cabinet.dll</pre><pre>Wadvapi32.dll</pre><pre>"%s" %s</pre><pre>/c "%s"</pre><pre>%Documents and Settings%\%current user%\Application Data</pre><pre>%Documents and Settings%\%current user%\Local Settings\Application Data</pre><pre>Global\{3D6E1BE3-083C-4088-F013-F140DE00D252}</pre>