Threat behavior
TrojanDownloader:Win32/Zlob.IB is generic detection for a component of the Win32/Zlob malware family. Win32/Zlob refers to a large multi-component family of malware that modifies Internet Explorer's settings, alters and redirects the user's default Internet search page and home page, and attempts to download and execute arbitrary files (including additional malicious software). The Win32/Zlob family has also been associated with rogue security programs that display misleading warnings regarding bogus malware infections.
Installation
When TrojanDownloader:Win32/Zlob.IB executes, it checks for an active Internet connection and makes the following registry modifications:
Adds value: "Path"
With data: "%ProgramFiles%\netproject"
To subkey: HKEY_CURRENT_USER\Software\NetProject
Adds value: "(default)"
With data: "{6bf52a52-394a-11d3-b153-00c04f79faa6}"
To subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\videoPl.chl\CLSID
It also drops a file "awer0.bat" into the %TEMP% folder.
Payload
Downloads and Executes Arbitrary Files
This trojan may attempt to connect to the IP address 85.255.119.242 and download arbitrary files. Downloaded files may be saved to the %TEMP% or %ProgramFiles%\netproject directories.
Analysis by Wei Li
Prevention
