Trojan-Spy:W32/Zbot.PUA

Classification

Category:Malware

Type:Trojan-Spy

Platform:W32

Aliases:

Trojan-Spy:W32/Zbot.PUB, Rootkit.39841, Trojan-Spy.Win32.Zbot.aovj

Summary

This type of trojan secretly installs spy programs and/or keylogger programs.

Removal

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.

Technical Details

Trojan-Spy:W32/Zbot.PUA is notable for being specifically designed to steal SMS messages containingm obile transaction authentication number (mTANs), which are like single-use passwords sent by banks to to their account holders' mobile phones to verify online transactions.

By stealing this information, attackers raiding a online bank account are able to perform transactions they would otherwise be unable to complete without offline authorization.

The trojan-spy first uses standard social engineering tactics (either phishing> or pharming) to deceive a user into giving out the username and password for their online bank accounts. The added twist for this this trojan-spy is that it also asks for the user's mobile phone details.

Based on the provided information, the trojan-spy then sends an SMS message to the user's phone, containing a link to a malicious mobile component, which we detect as Trojan:SymbOS/ZeusMitmo.A. This trojan is responsible for monitoring and stealing the SMS messages containing mTANs.

In our analysis, the mobile malware installed is a Symbian-signed file for S60 3rd Edition mobile phones. The file is named cert.sis; it may also be deceptively billed as a "Nokia Update". The mobile component has also been reported to be available in .jad files for Blackberry devices.