SonicALERT
Search

Sonicwall Signatures

 

Go to All Categories list.


  Zbot.FG_34
Zbot.FG_34 is a Trojan horse that attempts to steal confidential banking information from the compromised computer. It may also download configuration files and updates from the Internet. It is spread mainly through drive-by downloads and phishing schemes. Zbot is also called as Zeus.

Mutexes created
  • Nothing to report


Directory level activity
    • Nothing to report


    File level activity
      • Nothing to report


      Registry level activity
        • Nothing to report


        Library level activity
        • load - library - kernel32
        • load - library - kernel32.dll
        • load - library - KERNEL32.dll


        Process API calls used
        • VirtualProtectEx
        • VirtualProtectEx


        Registry API calls used
        • NtOpenKey
        • NtQueryValueKey
        • RegOpenKeyExA
        • RegQueryValueExA


        System API calls used
        • LdrLoadDll
        • LdrGetProcedureAddress
        • LdrGetProcedureAddress


        Filesystem API calls used
          • Nothing to report

          Network

          UDP source >> destination
          • 192.168.30.254 >> 192.168.30.8
          • 192.168.30.8 >> 192.168.30.255


          TCP source >> destination
          • 192.168.30.8 >> 192.168.30.254



          Domains:
          • NA

          DNS Request:
          • NA

          HTTP Request:
          • NA

          DLL related data
          Number of DLL's imported = 8
          • KERNEL32.dll
          • USER32.dll
          • GDI32.dll
          • ADVAPI32.dll
          • SHELL32.dll
          • ole32.dll
          • SHLWAPI.dll
          • COMCTL32.dll


          Relevant Information