Home > Threat descriptions >

Trojan-Spy:W32/Zbot.PUA

Classification

Category: Malware

Type: Trojan-Spy

Aliases: Trojan-Spy:W32/Zbot.PUB, Rootkit.39841, Trojan-Spy.Win32.Zbot.aovj

Summary


This type of trojan secretly installs spy programs and/or keylogger programs.

Removal


Automatic action

Based on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the detected program or file, or ask you for a desired action.

Knowledge Base

Find the latest advice in our Community Knowledge Base.

About the product

See the manual for your F-Secure product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details


Trojan-Spy:W32/Zbot.PUA is notable for being specifically designed to steal SMS messages containingm obile transaction authentication number (mTANs), which are like single-use passwords sent by banks to to their account holders' mobile phones to verify online transactions.

By stealing this information, attackers raiding a online bank account are able to perform transactions they would otherwise be unable to complete without offline authorization.

The trojan-spy first uses standard social engineering tactics (either phishing or pharming) to deceive a user into giving out the username and password for their online bank accounts. The added twist for this this trojan-spy is that it also asks for the user's mobile phone details.

Based on the provided information, the trojan-spy then sends an SMS message to the user's phone, containing a link to a malicious mobile component, which we detect as Trojan:SymbOS/ZeusMitmo.A. This trojan is responsible for monitoring and stealing the SMS messages containing mTANs.

In our analysis, the mobile malware installed is a Symbian-signed file for S60 3rd Edition mobile phones. The file is named cert.sis; it may also be deceptively billed as a "Nokia Update". The mobile component has also been reported to be available in .jad files for Blackberry devices.

This trojan-spy is also discussed in the following Labs Weblog post:

Description Created: 2010-09-28 04:34:23.0

Description Last Modified: 2010-09-28 05:22:15.0