Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RzxUpdate.exe] 'Debugger' = 'regsvr32 /s'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RzxZip.exe] 'Debugger' = 'regsvr32 /s'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CenterClient.exe] 'Debugger' = 'regsvr32 /s'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PartyClient.exe] 'Debugger' = 'regsvr32 /s'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UPD.exe] 'Debugger' = 'regsvr32 /s'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RzxPatch] 'Debugger' = 'regsvr32 /s'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\rzxnm] 'Start' = '00000001'
Вредоносные функции:
Создает и запускает на исполнение:
- '<SYSTEM32>\Diy9\Movie.exe'
- '<SYSTEM32>\Diy9\svchost.exe'
- '<SYSTEM32>\Diy9\Tao.exe'
- '%PROGRAM_FILES%\rzx\NAnalyser\RzxNAnalyser.exe'
- '<SYSTEM32>\Diy9\NAnalyser.exe'
- '<SYSTEM32>\Diy9\RegSet.exe'
- '<SYSTEM32>\Diy9\flash.exe'
- '<SYSTEM32>\Diy9\ie.exe'
- '<SYSTEM32>\Diy9\Sound.exe'
- '<SYSTEM32>\Diy9\SetAudio.exe'
Запускает на исполнение:
- '%WINDIR%\regedit.exe' /s Safe.reg
- '%WINDIR%\regedit.exe' /s Activex.reg
- '<SYSTEM32>\cacls.exe' "%PROGRAM_FILES%\rzx"\rzxsdk.dll /d everyone
- '<SYSTEM32>\regsvr32.exe' /u /s "%PROGRAM_FILES%\rzx"\rzxsdk.dll
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Policies\Microsoft\Windows\Network Connections" /v NC_LanProperties /t REG_DWORD /d 00000000 /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Policies\Microsoft\Windows\Network Connections"
- '<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wangba.dll
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Policies\Microsoft\Windows\Network Connections" /v NC_EnableAdminProhibits /t REG_DWORD /d 00000001 /f
- '<SYSTEM32>\taskkill.exe' /im RzxClient.exe /f
- '<SYSTEM32>\regsvr32.exe' /u /s "%PROGRAM_FILES%\rzx"\ClassHelper.dll
- '<SYSTEM32>\regsvr32.exe' /s %WINDIR%\msxml8.dll
- '<SYSTEM32>\attrib.exe' +s +h +r %WINDIR%\urlini.html
- '<SYSTEM32>\cacls.exe' "%PROGRAM_FILES%\rzx"\ClassHelper.dll /D everyone
- '%WINDIR%\regedit.exe' /s <SYSTEM32>\Diy9\ie.reg
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 10
- '<SYSTEM32>\attrib.exe' -h "%PROGRAM_FILES%"
- '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' Explorer\iexplore.exe http://www.23##.com/?k8#######
- '<SYSTEM32>\xcopy.exe' /y mms.cfg <SYSTEM32>\Macromed\Flash
- '<SYSTEM32>\reg.exe' delete HKEY_CURRENT_USER\Software\RealVNC\VNCViewer4\MRU /f
- '%WINDIR%\regedit.exe' /s ie.reg
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 3
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 5
- '<SYSTEM32>\wscript.exe' "<SYSTEM32>\Diy9\fucknbar.vbs"
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\en-zh\csrss.exe /p everyone:n
- '<SYSTEM32>\cacls.exe' %TEMP%\en-zh\csrss.exe /p everyone:n
- '<SYSTEM32>\regsvr32.exe' /u /s "<Имя диска съемного носителя>:\Hintsoft\GameMenu\Bin\BHOEx.dll"
- '<SYSTEM32>\cacls.exe' C:\upd.exe /D Everyone
- '<SYSTEM32>\attrib.exe' +h C:\upd.exe
- '<SYSTEM32>\cacls.exe' "%PROGRAM_FILES%"\PartyClient /p everyone:n
- '<SYSTEM32>\attrib.exe' +h "%PROGRAM_FILES%"\PartyClient
- '%WINDIR%\regedit.exe' /s rzx.reg
- '<SYSTEM32>\cacls.exe' "<Имя диска съемного носителя>:\Hintsoft\GameMenu\Bin\BHOEx.dll" /d everyone
- '<SYSTEM32>\taskkill.exe' /im upd.exe /f
- '<SYSTEM32>\taskkill.exe' /im PartyClient.exe /f
Изменяет следующие настройки браузера Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1004' = '00000000'
- [<HKCU>\Software\Microsoft\Internet Explorer\Main] 'Window Title' = ''
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\rzx\NAnalyser\Protocol\IPv4.ptl
- %PROGRAM_FILES%\rzx\NAnalyser\Protocol\PPPOE.ptl
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\2345[1]
- %PROGRAM_FILES%\rzx\NAnalyser\Protocol\Ethernet.ptl
- %PROGRAM_FILES%\rzx\NAnalyser\rc.d\parse_post\pst.sat
- %PROGRAM_FILES%\rzx\NAnalyser\rc.d\protocol_id.rc
- %PROGRAM_FILES%\rzx\NAnalyser\Protocol\Tcp.ptl
- %PROGRAM_FILES%\rzx\NAnalyser\Protocol\Udp.ptl
- %PROGRAM_FILES%\rzx\NAnalyser\Analyser\ansh.als
- %PROGRAM_FILES%\rzx\NAnalyser\Analyser\ansi.als
- %PROGRAM_FILES%\rzx\NAnalyser\Analyser\ansd.als
- %PROGRAM_FILES%\rzx\NAnalyser\Analyser\ansf.als
- %PROGRAM_FILES%\rzx\NAnalyser\Analyser\anst.als
- %PROGRAM_FILES%\rzx\NAnalyser\Analyser\Default.als
- %PROGRAM_FILES%\rzx\NAnalyser\Analyser\ansm.als
- %PROGRAM_FILES%\rzx\NAnalyser\Analyser\anss.als
- %PROGRAM_FILES%\rzx\NAnalyser\rc.d\rules\papde.sat
- %PROGRAM_FILES%\rzx\NAnalyser\ASFilter.sdb-journal
- %PROGRAM_FILES%\rzx\NAnalyser\ASFilter.sdb
- %PROGRAM_FILES%\rzx\NAnalyser\rc.d\weblogin_site.rc
- %PROGRAM_FILES%\rzx\NAnalyser\rc.d\webpage_title_prompt.rc
- %PROGRAM_FILES%\rzx\NAnalyser\NA.log
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\VoidRay_1122[1].php
- %PROGRAM_FILES%\rzx\NAnalyser\rzxnm.sys
- <DRIVERS>\rzxnm.sys
- %PROGRAM_FILES%\rzx\NAnalyser\rc.d\suffix_filter.rc
- %PROGRAM_FILES%\rzx\NAnalyser\rc.d\telnet_login_prompt.rc
- %PROGRAM_FILES%\rzx\NAnalyser\rc.d\save_response.rc
- %PROGRAM_FILES%\rzx\NAnalyser\rc.d\shttp_prompt.rc
- %PROGRAM_FILES%\rzx\NAnalyser\rc.d\webchatroom_site.rc
- %PROGRAM_FILES%\rzx\NAnalyser\rc.d\webidentify_site.rc
- %PROGRAM_FILES%\rzx\NAnalyser\rc.d\telnet_pass_prompt.rc
- %PROGRAM_FILES%\rzx\NAnalyser\rc.d\Version.ini
- <SYSTEM32>\Diy9\RegSet.exe
- <SYSTEM32>\Diy9\SetAudio.exe
- <SYSTEM32>\Diy9\Movie.exe
- <SYSTEM32>\Diy9\NAnalyser.exe
- <SYSTEM32>\Diy9\Tao.exe
- <SYSTEM32>\Diy9\ie.reg
- <SYSTEM32>\Diy9\Sound.exe
- <SYSTEM32>\Diy9\svchost.exe
- <SYSTEM32>\Diy9\mms.cfg
- <SYSTEM32>\Diy9\fucknbar.bat
- <SYSTEM32>\Diy9\Activex.reg
- <SYSTEM32>\Diy9\Safe.reg
- <SYSTEM32>\Diy9\flash.exe
- <SYSTEM32>\Diy9\ie.exe
- <SYSTEM32>\Diy9\fucknbar.vbs
- <SYSTEM32>\Diy9\ZP.ini
- <SYSTEM32>\Diy9\rzx.reg
- %PROGRAM_FILES%\rzx\NAnalyser\AnalysePost.dll
- %PROGRAM_FILES%\rzx\NAnalyser\Diag.dll
- %PROGRAM_FILES%\rzx\NAnalyser\NVersion.ini
- %PROGRAM_FILES%\rzx\NAnalyser\RzxNAnalyser.exe
- %PROGRAM_FILES%\rzx\NAnalyser\PAPDE.dll
- %PROGRAM_FILES%\rzx\NAnalyser\Seriface.dll
- %PROGRAM_FILES%\rzx\NAnalyser\npptools.dll
- %PROGRAM_FILES%\rzx\NAnalyser\Packet.dll
- %APPDATA%\2345.movie\2345_k82280095_movie.exe
- %APPDATA%\2345.movie\url.ini
- <SYSTEM32>\Macromed\Flash\mms.cfg
- %APPDATA%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol
- %WINDIR%\msxml8.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\VoidRay_1122[1].php
- %APPDATA%\2345.movie\影视大全.lnk
- %WINDIR%\urlini.html
Присваивает атрибут 'скрытый' для следующих файлов:
- %WINDIR%\urlini.html
Удаляет следующие файлы:
- <SYSTEM32>\Diy9\NAnalyser.exe
- <SYSTEM32>\Diy9\ie.exe
- <SYSTEM32>\Diy9\flash.exe
- <SYSTEM32>\Diy9\Tao.exe
- %PROGRAM_FILES%\rzx\NAnalyser\ASFilter.sdb-journal
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\VoidRay_1122[1].php
- <SYSTEM32>\Diy9\ZP.ini
- <SYSTEM32>\Diy9\Safe.reg
- <SYSTEM32>\Diy9\RegSet.exe
- <SYSTEM32>\Diy9\mms.cfg
- <SYSTEM32>\Diy9\SetAudio.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\VoidRay_1122[1].php
- <SYSTEM32>\Diy9\Movie.exe
- <SYSTEM32>\Diy9\rzx.reg
- <SYSTEM32>\Diy9\ie.reg
- <SYSTEM32>\Diy9\Sound.exe
- <SYSTEM32>\Diy9\Activex.reg
Сетевая активность:
Подключается к:
- '11#.#4.66.88':80
- '58.##1.133.251':80
- 'lp####ray.huo99.com':80
- 'lp#####ay.meimofang.com':80
- '61.##7.69.236':80
- 'localhost':1038
- 'lp#####ay.lingpao8.com':80
- 'lp#####ay.mai315.com':80
- 'www.23##.com':80
TCP:
Запросы HTTP GET:
- 11#.#4.66.88/VoidRay_1122.php?UI###################
- 58.##1.133.251/VoidRay_1122.php?UI###################
- lp####ray.huo99.com/VoidRay_1122.php?UI###################
- lp#####ay.meimofang.com/VoidRay_1122.php?UI###################
- www.23##.com/?k8#######
- lp#####ay.lingpao8.com/VoidRay_1122.php?UI###################
- 61.##7.69.236/VoidRay_1122.php?UI###################
- lp#####ay.mai315.com/VoidRay_1122.php?UI###################
UDP:
- DNS ASK lp####ray.huo99.com
- DNS ASK lp#####ay.mai315.com
- DNS ASK lp#####ay.meimofang.com
- DNS ASK lp#####ay.lingpao8.com
- DNS ASK www.23##.com
- 'localhost':18116
Другое:
Ищет следующие окна:
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WINHELP' WindowName: '(null)'
- ClassName: '{01E769AA-5576-44D6-ADB5-4DCC5A8A08DE}' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
- ClassName: '(null)' WindowName: '(null)'
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
