Threat description
This type of trojan secretly installs spy programs and/or keylogger programs.
Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.
More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.
You may also refer to the Knowledge Base on the F-Secure Community site for more information.
F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.
Trojan-Spy:W32/Zbot.PUA is notable for being specifically designed to steal SMS messages containingm obile transaction authentication number (mTANs), which are like single-use passwords sent by banks to to their account holders' mobile phones to verify online transactions.
By stealing this information, attackers raiding a online bank account are able to perform transactions they would otherwise be unable to complete without offline authorization.
The trojan-spy first uses standard social engineering tactics (either phishing or pharming) to deceive a user into giving out the username and password for their online bank accounts. The added twist for this this trojan-spy is that it also asks for the user's mobile phone details.
Based on the provided information, the trojan-spy then sends an SMS message to the user's phone, containing a link to a malicious mobile component, which we detect as Trojan:SymbOS/ZeusMitmo.A. This trojan is responsible for monitoring and stealing the SMS messages containing mTANs.
In our analysis, the mobile malware installed is a Symbian-signed file for S60 3rd Edition mobile phones. The file is named cert.sis; it may also be deceptively billed as a "Nokia Update". The mobile component has also been reported to be available in .jad files for Blackberry devices.
This trojan-spy is also discussed in the following Labs Weblog post:
Description Created: 2010-09-28 04:34:23.0
Description Last Modified: 2010-09-28 05:22:15.0
Suspect a file or URL was wrongly detected?
Send it to our Labs for further analysis
Give advice. Get advice. Share the knowledge on our free discussion forum.