TrojanDownloader:Win32/Zemot.A

Installation

This threat can be installed on your PC by the following malware: 

• Trojan:Win32/Alureon.FO
• Trojan:Win32/Tesch.B

When run, it creates the following file:

• %ALLUSERSPROFILE%\Application Data\Mozilla\<malware file name>.exe, where <malware file name>.exe is hardcoded inside the malware file. For example, %ALLUSERSPROFILE%\Application Data\Mozilla\jbvusrj.exe.

It also creates a scheduled task that runs the malware at each system start:

• %windir%\tasks\<malware file name>.job, where <malware file name>.job is hardcoded inside the malware file.

Payload

Downloads updates and other malware

The threat connects to a remote server to download updates and other malware. The server address is hardcoded in the malware.

We have seen it connect to the following servers:

• bluecreatureoftheseas<dot>com
• choose-music<dot>net
• dns-rabbit<dot>com
• every-documentation<dot>com 
• further-configuration<dot>com
• menaged-recognition<dot>com
• net-forwarding<dot>com
• net-translscl<dot>com 
• news-online24<dot>com
• one-discovery<dot>com 
• other-sale<dot>com
• pi-forwarding<dot>com 
• quality-whois<dot>com
• the-auto-company<dot>com
• shift-company<dot>com 
• yahyeu-domain<dot>com

It then downloads an updated version of itself and other malware files, including variants of:

• PWS:Win32/Zbot 
• TrojanDropper:Win32/Rovnix

The downloaded file is saved as %TEMP%\Java_Update_<random_characters>.exe, for example, %TEMP%\Java_Update_5a8bf3e9.exe

Analysis by Zarestel Ferrer