Troj/Bredo-ZT

Posted: June 27, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	9/10
Infected PCs:	75

First Seen:	June 27, 2012
Last Seen:	December 13, 2022
OS(es) Affected:	Windows

Troj/Bredo-ZT is a recently-discovered Trojan from the widespread Bredo family, and like many other Bredo-based Trojans, uses mass-distributed e-mail messages as its favored chariots. E-mail spam that contain Troj/Bredo-ZT have, so far, limited themselves to templates that claim to be notifications about money wire transferrals, with the corresponding file attachment being presented as a Word document or other type of harmless file. However, the file attachment actually is a .zip that's detected as Troj/BredoZp-KQ until it's unzipped and Troj/Bredo-ZT is installed. Since Troj/Bredo-ZT has shown some of the characteristics of a backdoor Trojan, including making contact with external IP addresses and altering the infected PC's Internet settings, SpywareRemove.com malware analysts recommend detecting and deleting Troj/Bredo-ZT with an anti-malware scanner with all possible expediency.

Troj/Bredo-ZT: a Faux Wire Transfer That's Giving You New Reasons to Distrust E-mail Attachments

While file attachments in e-mail messages are an extremely common means of distribution for various PC threats, Troj/Bredo-ZT appears to be content with re-treading this well-used path for propagation. Troj/Bredo-ZT e-mail spam is still ongoing as of late June 2012, and, thus far, always uses variants on a common 'money transfer' scam that claims that your transfer was rejected. The message goes on to claim that all is required for you to do is open the included file attachment for more information, but this file actually is an inaccurately-labeled .zip file (detected as Troj/BredoZP-KQ) that installs Troj/Bredo-ZT. SpywareRemove.com malware researchers have also seen similar attacks with other PC threats, particularly including other Bredo Trojans like Mal/BredoZp-B, Troj/Bredo-VV, Troj/Bredo-QI and Troj/Bredo-RK.

Headers for Troj/Bredo-ZT's e-mail messages can vary, but, at the time of this writing, always include a mention of a wire transfer. They may also include fake transaction reference numbers or tags that imply that these messages have been forwarded from another mailbox. Non-Windows computers can be considered immune to Troj/Bredo-ZT attacks even if they open the relevant file, since Troj/Bredo-ZT is specific to the Windows operating system (although these OSes may be attacked successfully by unrelated PC threats in a similar manner).

The Practical Results of Embracing Troj/Bredo-ZT's Wire Transfer Hoax

As a new Bredo variant, Troj/Bredo-ZT hasn't yet been completely analyzed, and SpywareRemove.com malware experts emphasize keeping all of your anti-malware programs updated if you want to have a good chance of detecting either prior to its installation or afterward its installation. Nonetheless, functions of Troj/Bredo-ZT that have been confirmed include:

Unauthorized alterations of Windows components, including the Windows Registry.
Unauthorized changes to your Internet settings; this can make your PC unusually vulnerable to other attacks, up to and potentially including allowing criminals to access your computer through Command & Control servers.
The creation of fake Windows files (such as cmd.exe) that are used for malicious purposes.
Contact with remote IP addresses; Troj/Bredo-ZT may do this to transfer stolen information or to download and install other forms of hostile software.

Deleting Troj/Bredo-ZT e-mails on sight is the surest way to protect your computer from Troj/Bredo-ZT, and SpywareRemove.com malware research team always encourages you to scan e-mail files prior to downloading them.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

file.exe

File name: file.exe
Size: 79.87 KB (79872 bytes)
MD5: aaf1b4500c6443ab9b52e55bc21f2266
Detection count: 54
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: June 28, 2012

file.exe

File name: file.exe
Size: 82.79 KB (82798 bytes)
MD5: 8e6bf45bbdfbbd5d4082f8bbc8a236a0
Detection count: 53
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: June 28, 2012

file.exe

File name: file.exe
Size: 82.21 KB (82214 bytes)
MD5: 40eac511eb5e5d9b71e768d3d3d25602
Detection count: 52
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: June 28, 2012

Transaction_N48823.zip

File name: Transaction_N48823.zip
Size: 57.67 KB (57677 bytes)
MD5: a3f5df415903a755a7f385a238d53b8e
Detection count: 41
Mime Type: unknown/zip
Group: Malware file
Last Updated: June 28, 2012

Wire_Transfer_N883273_Details.exe

File name: Wire_Transfer_N883273_Details.exe
Size: 94.2 KB (94208 bytes)
MD5: a0fb84626eb64b273cdaf802dd09451e
Detection count: 38
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: June 28, 2012

Troj/Bredo-ZT

Threat Metric

Troj/Bredo-ZT: a Faux Wire Transfer That's Giving You New Reasons to Distrust E-mail Attachments

The Practical Results of Embracing Troj/Bredo-ZT's Wire Transfer Hoax

Technical Details

File System Modifications

Leave a Reply