Home / malware

PDF

TrojanDownloader:Win32/Zbot.I

First posted on 11 June 2013.
Source: Microsoft

Aliases :

TrojanDownloader:Win32/Zbot.I is also known as TROJ_SPNR.10E013 (Trend Micro), Backdoor.Win32.Autoit.be (Kaspersky), Troj/Autoit-TE (Sophos).

Explanation :

TrojanDownloader:Win32/Zbot.I is a trojan that silently downloads and installs other programs without consent. This could include the installation of additional malware or malware components to an affected computer. Installation TrojanDownloader:Win32/Zbot.I creates the following files on an affected computer:

• c:\documents and settings\administrator\local settings\temp\draft.ini

Payload Contacts remote hosts TrojanDownloader:Win32/Zbot.I may contact the following remote hosts using port 80:

• caccnet.client.jp
• zalfi.sakura.ne.jp

Commonly, malware may contact a remote host for the following purposes:

• To confirm Internet connectivity
• To report a new infection to its author
• To receive configuration or other data
• To download and execute arbitrary files (including updates or additional malware)
• To receive instruction from a remote attacker
• To upload data taken from the affected computer

This malware description was produced and published using our automated analysis system's examination of file SHA1 bccc6b59c310773b65324b8965960f3d20adb477.

Last update 11 June 2013

 

TOP