TROJ_ZBOT.BTM
TROJ_ZBOT.BTM is a harmful Trojan that can use the internet to communicate with a remote server. TROJ_ZBOT.BTM will download harmful files from this server and send a victim's stolen information to it. TROJ_ZBOT.BTM is able to steal its victims' online banking details by monitoring when the victims access certain banking websites. The stolen data is later sent to a remote attacker, who can use it to commit fraudulent crimes, via HTTP POST.
File System Details
TROJ_ZBOT.BTM may create the following file(s):
| # | File Name |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|
| 1. | sdra64.exe | |
| 2. | %System%\lowsec |
Registry Details
TROJ_ZBOT.BTM may create the following registry entry or registry entries:
Userinit = "%System%\userinit.exe, %System%\sdra64.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Services\SharedAccess\Parameters\ FirewallPolicy\StandardProfile
Windows NT\CurrentVersion\Winlogon
UID = "{Computer name}_{Random numbers}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Network
EnableFirewall = "0"
