About:
Troj/Zbot-JS is a member of the Zbot family of malware, also known as Zeus. It is aggressively spammed out in multiple campaigns with various social engineering lures.
The spammers behind this scheme use fake password reset emails such as:
Subject: Myspace Password Reset Confirmation
Because of the measures taken to provide safety to our clients, your
password has been changed. You can find your new password in attached
document.
The also employs fake delivery notices, similar to those seen recently in fake anti-virus scams:
Thank you for setting the order No.8794354
Thank you for ordering at our online store. Your order: Sony VAIO
VPC-X11Z1E/X, was sent at your address. The tracking number of your
postal parcel is indicated in the document attached to this letter.
Please, print out the postal label for receiving the parcel.
In both cases, the file attached to the email message is a zip file that contains a malicious program.
When run, Troj/Zbot-JS copies itself to the Windows system directory as sdra64.exe. It changes a registry entry to make sure the file is run when Windows starts:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
Usually this registry data is set to C:\WINDOWS\system32\userinit.exe, but now the Trojan will add its own name, changing the data to:
C:\WINDOWS\system32\userinit.exe, C:\WINDOWS\system32\sdra64.exe
When active, Troj/Zbot-JS opens a random high-numbered TCP port for listening. Members of the Zbot malware family typically allow a remote attacker to take control of a computer and subsequently spy on its activity. Zbot Trojans are often associated with online banking theft.
Users of the HIPS runtime behavior analysis features of Sophos Endpoint Security have additional protection against Troj/Zbot-JS. When this Trojan attempts to install itself, it triggers the HIPS rule HIPS/FileMod-001.