Win32/Zlader [Threat Name] go to Threat
Win32/Zlader.F [Threat Variant Name]
| Category | trojan |
| Size | 102400 B |
| Aliases | Trojan-PSW.Win32.Tepfer.qxtk (Kaspersky) |
| Trojan:Win32/Stoberox.B (Microsoft) | |
| Downloader.Ponik (Symantec) |
Short description
Win32/Zlader.F is a trojan that steals sensitive information.
Installation
The trojan does not create any copies of itself.
Information stealing
The trojan collects the following information:
- operating system version
- FTP account information
- Windows Protected Storage passwords and credentials
The trojan collects information related to the following applications:
- FAR Manager
- Total Commander
- WS_FTP
- CuteFTP
- FlashFXP
- FileZilla
- FTP Commander
- BulletProof FTP
- SmartFTP
- TurboFTP
- FFFTP
- CoffeeCup FTP
- CoreFTP
- FTP Explorer
- Frigate3 FTP
- SecureFX
- UltraFXP
- FTPRush
- WebSitePublisher
- BitKinex
- ExpanDrive
- ClassicFTP
- Fling
- SoftX
- Directory Opus
- FreeFTP
- DirectFTP
- LeapFTP
- WinSCP
- 32bit FTP
- NetDrive
- WebDrive
- FTP Control
- Opera
- WiseFTP
- FTP Voyager
- Firefox
- FireFTP
- SeaMonkey
- Flock
- Mozilla Suite Browser
- LeechFTP
- Odin Secure FTP Expert
- WinFTP
- FTP Surfer
- FTPGetter
- ALFTP
- Internet Explorer
- Dreamweaver
- DeluxeFTP
- Google Chrome
- Chromium
- SRWare Iron
- ChromePlus
- Bromium
- Nichrome
- Comodo Dragon
- RockMelt
- K-Meleon
- Epic
- Staff-FTP
- AceFTP
- Global Downloader
- FreshFTP
- BlazeFTP
- NETFile
- GoFTP
- 3D-FTP
- Easy FTP
- Xftp
- FTP Now
- Robo-FTP
- LinasFTP
- Cyberduck
- Putty
- Notepad + + (NppFTP)
- CoffeeCup Visual Site Designer
- CoffeeCup Sitemapper
- FTPShell
- FTPInfo
- NexusFile
- FastStone Browser
- CoolNovo
- WinZip
- Yandex.Internet
- MyFTP
- Sherrod FTP
- NovaFTP
- Windows Mail
- Windows Live Mail
- Pocomail
- Becky!
- IncrediMail
- The Bat!
- Outlook
- Thunderbird
- FastTrackFTP
The trojan attempts to send gathered information to a remote machine. The HTTP protocol is used.
Other information
The trojan creates and runs a new thread with its own program code within the following processes:
- %malwarefilepath%
- %system%\wuauclt.exe
- %system%\svchost.exe
The trojan contains a URL address. The trojan may attempt to download files from the Internet.
The file is stored in the following location:
- %temp%\%variable%
A string with variable content is used instead of %variable% .
The file is then executed.
Trojan may remove itself from the infected computer.
The trojan executes the following command:
- wmic process call create "cmd.exe /c del %malwarefilepath%"