Win32/Zemot

Installation

It will try to create the following registry entries and keys to mark its installation. This way, when it checks a remote server it knows if it needs to update itself or not.

In subkey: HKLM\<random>, for example HKCU\Software\Osnuafczni
Sets value: "License"
With data: "<version number of the malware", for example "415"

In subkey: HKCU\<random>, for example HKLM\Software\Osnuafczni
Sets value: "License"
With data: "<version number of the malware", for example "415"

Payload

Downloads updates and other malware

The threat connects to a remote server to download updates and other malware. The server address is hardcoded in the malware.

We have seen it connect to the following servers:

It then downloads an updated version of itself and other malware files, including variants of:

• PWS:Win32/Zbot - used for click fraud
• TrojanDropper:Win32/Rovnix - used to drop more malware on your PC

The downloaded file is saved as one of the following:

•  %TEMP%\Java_Update_<random_characters>.exe, for example, %TEMP%\Java_Update_5a8bf3e9.exe
•  %TEMP%\UpdateFlashPlayer_<random_characters>.exe, for example, %TEMP%\UpdateFlashPlayer_b61c21a2.exe

Here is what the infection chain looks like (at the time of analysis) as Zemot is dropped by an email generated by Kuluoz spambot:

Analysis by Patrick Estavillo