Threat Name: Trojan-Spy.Win32.Zbot.gen (fs)
Category : Trojan
Advice : Quarantine
Description : It injects code from a remote site to steal information from its victims, including cached passwords, login credentials for web sites (chiefly banks) as well as data in certificates and cookies. It has some backdoor functionality and may record keystrokes.

Spam campaign # 1

There are reports that it was distributed through spam email, in some instances as a file purporting to be an airline e-ticket.

Spam campaign # 2

In another instance, it was included in a spam from an alleged “United Parcel Service of America” as an infected attachment with the file name UPS_NNR01.zip

-------- Original Message --------
Subject: Ninja Killed - Postal Tracking #PSGMR64782BY2C2
Date: Wed, 15 Apr 2009 16:32:50 +0900
From: United Parcel Service of America ottorios@ibfd.com
To: recipient.com

Hello!

We were not able to deliver postal package you sent on the 14th of March in time because the recipient’s address is not correct.
.
Please print out the invoice copy attached and collect the package at our office.

Your United Parcel Service of America

Spam campaign # 3

In a third campaign in April, 2009, it was being spread as an infected attachment in a spam e-mail, claiming to be an e-payment notification of an order with Amazon.com:

Subject: WorldPay CARD transaction Confirmation
Attachment: WorldPay_TRANS_8651.zip

Thank you!

Your transaction has been processed by WorldPay, on behalf of Amazon Inc.
The invoice file is attached to this message.
This is not a tax receipt.
We processed your payment.
Amazon Inc has received your order,
and will inform you about delivery.
Sincerely,
Amazon Team

This confirmation only indicates that your transaction has been processed successfully.
It does not indicate that your order has been accepted.
It is the responsibility of Amazon Inc to confirm that
your order has been accepted, and to deliver any goods or services you have ordered.

Other names:

F-Secure: Trojan-Spy.Win32.Zbot.gen
Kaspersky: Trojan-Spy.Win32.Zbot.gen
McAfee: Generic PWS.y
Microsoft: PWS:Win32/Zbot.M
TrendMicro: TSPY_ZBOT.BAM

Files created:

We have documented more than 2,700 files related to Trojan-Spy.Win32.Zbot.gen (fs) since it was first detected..

Folders created:

Trojan-Spy.Win32.Zbot.gen (fs) has been known to create the following folders:

%SYSTEM%\WSNPOEM
%SYSTEM%\WSNPOEMA
C:\Documents and Settings\NetworkService\Application Data\wsnpoem
%SYSTEM%\twain_32
%SYSTEM%\lowsec

sumber : http://www.sunbeltsecurity.com/Threa...0347E53186ABD5