Home / malware Trojan-Spy:W32/Zbot.PUA
First posted on 28 September 2010.
Source: SecurityHomeAliases :
There are no other names known for Trojan-Spy:W32/Zbot.PUA.
Explanation :
This type of trojan secretly installs spy programs and/or keylogger programs.
Additional DetailsTrojan-Spy:W32/Zbot.PUA is notable for being specifically designed to steal SMS messages containing mobile transaction authentication number (mTANs), which are like single-use passwords sent by banks to to their account holders' mobile phones to verify online transactions.
By stealing this information, attackers raiding a online bank account are able to perform transactions they would otherwise be unable to complete without offline authorization.
The trojan-spy first uses standard social engineering tactics (either phishing or pharming) to deceive a user into giving out the username and password for their online bank accounts. The added twist for this this trojan-spy is that it also asks for the user's mobile phone details.
Based on the provided information, the trojan-spy then sends an SMS message to the user's phone, containing a link to a malicious mobile component, which we detect as Trojan:SymbOS/ZeusMitmo.A. This trojan is responsible for monitoring and stealing the SMS messages containing mTANs.
In our analysis, the mobile malware installed is a Symbian-signed file for S60 3rd Edition mobile phones. The file is named cert.sis; it may also be deceptively billed as a "Nokia Update". The mobile component has also been reported to be available in .jad files for Blackberry devices.
This trojan-spy is also discussed in the following Labs Weblog post:
€ ZeuS Variants Targeting Mobile BankingLast update 28 September 2010
