Troj/Zbot-MV is a Trojan for the Windows platform.
Troj/Zbot-MV includes functionality to:
- run automatically
- copy itself to the <System> folder
- create files in the <System> folder
- steal confidential information
- access the internet and communicate with a remote server via HTTP
Troj/Zbot-MV communicates via HTTP with the following locations:
sexycheck . net
When Troj/Zbot-MV is installed the following files are created:
<System>\lowsec\local.ds
<System>\lowsec\user.ds
<System>\sdra64.exe
Registry entries are set as follows:
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Connections
DefaultConnectionSettings
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
Winlogon
Userinit
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Connections
SavedLegacySettings
Registry entries are created under:
HKCU\Software\Microsoft\Protected Storage System Provider