Home Malware Programs Trojans PWS:Win32/Zbot.gen!AK

PWS:Win32/Zbot.gen!AK

Posted: December 17, 2012

Threat Metric

Threat Level: 9/10
Infected PCs: 1
First Seen: December 17, 2012
OS(es) Affected: Windows

PWS:Win32/Zbot.gen!AK is Trojan that allows attackers to gain unauthorized remote access and control of the infected computer, and steals personal information, such as online banking and shopping passwords, email credentials and network information from victims. PWS:Win32/Zbot.gen!AK is distributed and installed on the affected computer by other malware threats, downloaded as a payload for exploit kits such as blackhole, detected as Blacole, or spammed out attached to email. Once executed, PWS:Win32/Zbot.gen!AK creates a modified copy of itself with a randomly-generated file name in the certain location. PWS:Win32/Zbot.gen!AK then modifies the Windows Registry to assure that this copy is executed every time Windows is started. PWS:Win32/Zbot.gen!AK also creates copies of itself in the default user startup folder. PWS:Win32/Zbot.gen!AK inserts a code into all the affected PC user's running processes to disguise its existence from security software. PWS:Win32/Zbot.gen!AK attempts to propagates to other computers that might be remotely connected to the targeted PC using the Remote Desktop Service (RDS). If your computer is running a Remote Desktop

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



35c88a3c5319270976199e5575661300 File name: 35c88a3c5319270976199e5575661300
Size: 312.32 KB (312320 bytes)
MD5: 35c88a3c5319270976199e5575661300
Detection count: 84
Group: Malware file
Last Updated: March 5, 2013
468fa62f8fc5b951448d520744c6cf69 File name: 468fa62f8fc5b951448d520744c6cf69
Size: 190.56 KB (190560 bytes)
MD5: 468fa62f8fc5b951448d520744c6cf69
Detection count: 75
Group: Malware file
Last Updated: March 5, 2013
%APPDATA%\<RANDOM LETTERS>\<RANDOM LETTERS>.exe File name: %APPDATA%\<RANDOM LETTERS>\<RANDOM LETTERS>.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
C:\Documents and Settings\<username>\application data\eqepys\ruynn.exe File name: C:\Documents and Settings\<username>\application data\eqepys\ruynn.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
<DefaultUserPath>\Programs\Startup\<RANDOM LETTERS>.exe File name: <DefaultUserPath>\Programs\Startup\<RANDOM LETTERS>.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
C:\Users\<username>\\Programs\Startup\<RANDOM LETTERS>.exe File name: C:\Users\<username>\\Programs\Startup\<RANDOM LETTERS>.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
C:\Users\<username>\\Programs\Startup\<RANDOM LETTERS>.exe File name: C:\Users\<username>\\Programs\Startup\<RANDOM LETTERS>.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
C:\Documents and Settings\<username>\\Programs\Startup\<RANDOM LETTERS>.exe File name: C:\Documents and Settings\<username>\\Programs\Startup\<RANDOM LETTERS>.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
C:\Documents and Settings\<username>\\Programs\Startup\<RANDOM LETTERS>.exe File name: C:\Documents and Settings\<username>\\Programs\Startup\<RANDOM LETTERS>.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Run "{GUID of Windows volume}" = "%APPDATA%\\.exe"HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Run {F38B3E05-4020-AD7D-5A64-4EC179C86DD3}" " = "c:\documents and settings\administrator\application data\eqepys\ruynn.exe"
Loading...