Win32/Zemot

Installation

Payload

It will try to create the following registry entries and keys to mark its installation. This way, when it checks a remote server it knows if it needs to update itself or not.

In subkey: , for example Sets value: ""With data: "", for example ""HKLM\<random>415HKCU\Software\OsnuafczniLicense<version number of the malware

In subkey: Sets value: ""With data: "", for example ""HKCU\<random>415, for example HKLM\Software\OsnuafczniLicense<version number of the malware

Downloads updates and other malware

The threat connects to a remote server to download updates and other malware. The server address is hardcoded in the malware.

We have seen it connect to the following servers:

It then downloads an updated version of itself and other malware files, including variants of:

The downloaded file is saved as one of the following:

Here is what the infection chain looks like (at the time of analysis) as Zemot is dropped by an email generated by spambot:Kuluoz

Analysis by Patrick Estavillo

• PWS:Win32/Zbot click fraud - used for
• TrojanDropper:Win32/Rovnix - used to drop more malware on your PC

•  , for example, %TEMP%\Java_Update_<random_characters>.exe%TEMP%\Java_Update_5a8bf3e9.exe
•  , for example, %TEMP%\UpdateFlashPlayer_<random_characters>.exe%TEMP%\UpdateFlashPlayer_b61c21a2.exe