TSPY_ZBOT.ADD

Posted: August 21, 2013

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	9/10
Infected PCs:	28

First Seen:	August 21, 2013
Last Seen:	May 8, 2022
OS(es) Affected:	Windows

TSPY_ZBOT.ADD is a variant of the banking Trojan Zeus, including all of the expected bank account data-stealing attacks along with a new distribution technique involving a second Trojan (identified as TSPY_FAREIT.ADI) and tax-themed e-mail spam. Because TSPY_ZBOT.ADD's symptoms are limited to those TSPY_ZBOT.ADD deems necessary for stealing your personal information and its distribution strategy involves tricking the victim into thinking that they're downloading something else entirely, a TSPY_ZBOT.ADD infection easily may compromise a bank account while leaving you oblivious... until your money begins to disappear. Anti-malware software and good Web-browsing habits continue to be your best defenses against spyware like TSPY_ZBOT.ADD and TSPY_FAREIT.ADI, which SpywareRemove.com malware experts classify as high-level PC threats.

When a Browser Attack is Included in Your Tax Returns

TSPY_ZBOT.ADD is one of the newer versions of Trojan Zeus to be confirmed to be distributed in the wild, with its infection vectors consisting of a multiple-stage attack that starts at your digital mailbox. Spam e-mail messages recently sent out to various targets in the UK claimed to be notifications of successful VAT (or Value-Added Tax) return forms, with additional information provided in an enclosed ZIP attachment. Of course, this ZIP file actually is a Trojan dropper that installs TSPY_FAREIT.ADI, a backdoor Trojan and spyware program that simultaneously steals information (from Web browsers, FTP clients and other programs) while also opening a backdoor for further attacks. Even alone, TSPY_FAREIT.ADI is capable of being an impressive security hazard, but SpywareRemove.com malware researchers also confirmed TSPY_FAREIT.ADI's installation of a second Trojan: TSPY_ZBOT.ADD.

TSPY_ZBOT.ADD is a Trojan that uses Man-in-the-browser attacks to intercept your Web browser communications whenever you visit one of a list of pre-specified banking websites. However, TSPY_ZBOT.ADD isn't limited to monitoring and stealing information passively; TSPY_ZBOT.ADD also may take an active role in its thefts. By injecting malicious Web content into your browser, TSPY_ZBOT.ADD can request further information for TSPY_ZBOT.ADD to steal. These requests are formatted to look like additional security procedures from the bank website.

SpywareRemove.com malware researchers stress that these changes only take place within your PC and do not affect the bank website. Thus, PC users who don't catch TSPY_ZBOT.ADD in time may find that their accounts are subjected to fraudulent cash transfers and other issues before the bank has any clues of a potential problem.

Adding Safety from TSPY_ZBOT.ADD to Your Online Banking Habits

Detecting and deleting TSPY_ZBOT.ADD or its fellow Fareit Trojan will require using anti-malware programs – since both of these PC threats include advanced defenses against casual deletion and often will not show any symptoms to be detected by at all. Above all else, avoiding the infection vectors responsible for TSPY_ZBOT.ADD's attacks will keep your PC as safe as possible, and British residents should be especially on the watch for tax-themed e-mail spam reminiscent of TSPY_ZBOT.ADD's attack campaign.

As a parting note, SpywareRemove.com malware researchers also mention that ZIP-packaged file attachments are one of the most common vehicles for transferring malware to new computers due to the minor protection provided by archive-based file obfuscation. However, suitably competent anti-malware utilities shouldn't have any problems in detect PC threats related to TSPY_ZBOT.ADD, regardless of whether they're zipped or unzipped.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

VAT_7808740.zip

File name: VAT_7808740.zip
Mime Type: unknown/zip
Group: Malware file

Additional Information

The following messages's were detected:

#	Message
1	'Thank you for sending your VAT Return online. The submission for reference 7809740 was successfully received on Wed, 24 July 2013 08:38:54 +0100 and is being processed. Make VAT Returns is just one of the many online services we offer that can save you time and paperwork,” the bogus emails read.