TSPY_ZBOT.THY

TSPY_ZBOT.THY is a Trojan that is a variation of a banking Trojan called KINS, dubbed 'the next ZeuS' by media reports. TSPY_ZBOT.THY encompasses advanced anti-debugging and anti-analysis routines. To block analysis and debugging, TSPY_ZBOT.THY looks for and ceases running if it finds it is being executed inside several well-known virtual machine servers (particularly, VMWare and VirtualBox) or a Windows emulator (WINE). Similarly, other security tools such as Sandboxie will also make TSPY_ZBOT.THY to stop running. TSPY_ZBOT.THY drops a configuration file that involves the list of attacked banks, drops zone websites, and webinjects files. TSPY_ZBOT.THY steals online banking data such as user credentials by embedding a certain code onto the victim's web browsers when he/she visits particular domains in real time. When done, TSPY_ZBOT.THY displays bogus legal pop-up warning messages that ask to disclose banking credentials and additional information such as social security number.