Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'calendar' = '"%PROGRAM_FILES%\zmrili\zmrili.exe" -start'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\ZmPlatform] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\zmrili\zmrili.exe' -start
- '%CommonProgramFiles%\ZMRL\ZmPlatform.exe'
- '%CommonProgramFiles%\ZMRL\ZmPlatform.exe' /install
Внедряет код в
следующие системные процессы:
- %WINDIR%\Explorer.EXE
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\zmrili\Skin\res\history.xml
- %PROGRAM_FILES%\zmrili\Skin\res\l_bg.png
- %PROGRAM_FILES%\zmrili\Skin\res\MainFrame.xml
- %PROGRAM_FILES%\zmrili\Skin\res\day_today.png
- %PROGRAM_FILES%\zmrili\Skin\res\day_duty.png
- %PROGRAM_FILES%\zmrili\Skin\res\day_free.png
- %PROGRAM_FILES%\zmrili\Skin\res\day_hover.png
- %PROGRAM_FILES%\zmrili\Skin\res\main_arrow_left.png
- %PROGRAM_FILES%\zmrili\Skin\res\weather0.png
- %PROGRAM_FILES%\zmrili\Skin\res\weather1.png
- %PROGRAM_FILES%\zmrili\Skin\res\weather10.png
- %PROGRAM_FILES%\zmrili\Skin\res\waiting.gif
- %PROGRAM_FILES%\zmrili\Skin\res\main_arrow_right.png
- %PROGRAM_FILES%\zmrili\Skin\res\scrollbar.png
- %PROGRAM_FILES%\zmrili\Skin\res\task.xml
- %TEMP%\ini001\Skin\setup\setup.xml
- %TEMP%\ini001\NDuilib.dll
- %PROGRAM_FILES%\zmrili\CalendarDll32.dll
- %TEMP%\ini001\Skin\setup\option.png
- %TEMP%\ini001\Skin\setup\loadingpic.png
- %TEMP%\ini001\Skin\setup\logo.png
- %TEMP%\ini001\Skin\setup\ok.png
- %PROGRAM_FILES%\zmrili\CalendarDll64.dll
- %PROGRAM_FILES%\zmrili\libcurld.dll
- %PROGRAM_FILES%\zmrili\NDuilib.dll
- %PROGRAM_FILES%\zmrili\Skin\res\btn_close.png
- %PROGRAM_FILES%\zmrili\Inject64.exe
- %PROGRAM_FILES%\zmrili\Helper.dll
- %PROGRAM_FILES%\zmrili\HistoryToday.db
- %PROGRAM_FILES%\zmrili\H_today.db
- %PROGRAM_FILES%\zmrili\Skin\res\weather11.png
- %PROGRAM_FILES%\zmrili\Skin\res\weather5.png
- %PROGRAM_FILES%\zmrili\Skin\res\weather6.png
- %PROGRAM_FILES%\zmrili\Skin\res\weather7.png
- %PROGRAM_FILES%\zmrili\Skin\res\weather4.png
- %PROGRAM_FILES%\zmrili\Skin\res\weather26.png
- %PROGRAM_FILES%\zmrili\Skin\res\weather27.png
- %PROGRAM_FILES%\zmrili\Skin\res\weather3.png
- %PROGRAM_FILES%\zmrili\Skin\res\weather8.png
- %PROGRAM_FILES%\zmrili\zmrili.exe
- <DRIVERS>\BootIME7.sys
- %APPDATA%\Cache\Mini.exe
- %PROGRAM_FILES%\zmrili\yiji.db
- %PROGRAM_FILES%\zmrili\Skin\res\weather9.png
- %PROGRAM_FILES%\zmrili\Skin\res\Weather_none.png
- %PROGRAM_FILES%\zmrili\sqlite3.dll
- %PROGRAM_FILES%\zmrili\Skin\res\weather16.png
- %PROGRAM_FILES%\zmrili\Skin\res\weather17.png
- %PROGRAM_FILES%\zmrili\Skin\res\weather18.png
- %PROGRAM_FILES%\zmrili\Skin\res\weather15.png
- %PROGRAM_FILES%\zmrili\Skin\res\weather12.png
- %PROGRAM_FILES%\zmrili\Skin\res\weather13.png
- %PROGRAM_FILES%\zmrili\Skin\res\weather14.png
- %PROGRAM_FILES%\zmrili\Skin\res\weather19.png
- %PROGRAM_FILES%\zmrili\Skin\res\weather23.png
- %PROGRAM_FILES%\zmrili\Skin\res\weather24.png
- %PROGRAM_FILES%\zmrili\Skin\res\weather25.png
- %PROGRAM_FILES%\zmrili\Skin\res\weather22.png
- %PROGRAM_FILES%\zmrili\Skin\res\weather2.png
- %PROGRAM_FILES%\zmrili\Skin\res\weather20.png
- %PROGRAM_FILES%\zmrili\Skin\res\weather21.png
- %TEMP%\ini001\Skin\setup\loadingbg.png
- %TEMP%\zmsetup\Skin\res\weather11.png
- %TEMP%\zmsetup\Skin\res\weather12.png
- %TEMP%\zmsetup\Skin\res\weather13.png
- %TEMP%\zmsetup\Skin\res\weather10.png
- %TEMP%\zmsetup\Skin\res\scrollbar.png
- %TEMP%\zmsetup\Skin\res\weather0.png
- %TEMP%\zmsetup\Skin\res\weather1.png
- %TEMP%\zmsetup\Skin\res\weather14.png
- %TEMP%\zmsetup\Skin\res\weather19.png
- %TEMP%\zmsetup\Skin\res\weather2.png
- %TEMP%\zmsetup\Skin\res\weather20.png
- %TEMP%\zmsetup\Skin\res\weather18.png
- %TEMP%\zmsetup\Skin\res\weather15.png
- %TEMP%\zmsetup\Skin\res\weather16.png
- %TEMP%\zmsetup\Skin\res\weather17.png
- %TEMP%\ini001\setupres.7z
- %CommonProgramFiles%\ZMRL\config.dat
- %TEMP%\zmsetup\Skin\res\waiting.gif
- %CommonProgramFiles%\ZMRL\ZmPlatform.exe
- %WINDIR%\system\7z.dll
- %WINDIR%\system\Client7z.dll
- %TEMP%\zmsetup\ires.7z
- %TEMP%\zmsetup\Skin\res\btn_close.png
- %TEMP%\zmsetup\Skin\res\l_bg.png
- %TEMP%\zmsetup\Skin\res\main_arrow_left.png
- %TEMP%\zmsetup\Skin\res\main_arrow_right.png
- %TEMP%\zmsetup\Skin\res\day_today.png
- %TEMP%\zmsetup\Skin\res\day_duty.png
- %TEMP%\zmsetup\Skin\res\day_free.png
- %TEMP%\zmsetup\Skin\res\day_hover.png
- %TEMP%\zmsetup\Skin\res\weather21.png
- %TEMP%\zmsetup\yiji.db
- %TEMP%\zmsetup\Inject64.exe
- %TEMP%\zmsetup\zmrili.exe
- %TEMP%\zmsetup\H_today.db
- %TEMP%\zmsetup\Skin\res\MainFrame.xml
- %TEMP%\zmsetup\Skin\res\task.xml
- %TEMP%\zmsetup\HistoryToday.db
- %TEMP%\zmsetup\CalendarDll32.dll
- %TEMP%\zmsetup\sqlite3.dll
- %TEMP%\ini001\Skin\setup\closehot.png
- %TEMP%\ini001\Skin\setup\closenormal.png
- %TEMP%\zmsetup\NDuilib.dll
- %TEMP%\zmsetup\CalendarDll64.dll
- %TEMP%\zmsetup\Helper.dll
- %TEMP%\zmsetup\libcurld.dll
- %TEMP%\zmsetup\Skin\res\weather26.png
- %TEMP%\zmsetup\Skin\res\weather27.png
- %TEMP%\zmsetup\Skin\res\weather3.png
- %TEMP%\zmsetup\Skin\res\weather25.png
- %TEMP%\zmsetup\Skin\res\weather22.png
- %TEMP%\zmsetup\Skin\res\weather23.png
- %TEMP%\zmsetup\Skin\res\weather24.png
- %TEMP%\zmsetup\Skin\res\weather4.png
- %TEMP%\zmsetup\Skin\res\weather9.png
- %TEMP%\zmsetup\Skin\res\Weather_none.png
- %TEMP%\zmsetup\Skin\res\history.xml
- %TEMP%\zmsetup\Skin\res\weather8.png
- %TEMP%\zmsetup\Skin\res\weather5.png
- %TEMP%\zmsetup\Skin\res\weather6.png
- %TEMP%\zmsetup\Skin\res\weather7.png
Удаляет следующие файлы:
- %TEMP%\zmsetup\ires.7z
- %TEMP%\ini001\setupres.7z
- %WINDIR%\system\7z.dll
- %WINDIR%\system\Client7z.dll
Сетевая активность:
Подключается к:
- 'in#.###ol.sina.com.cn':80
- 'up####.zmrili.com':80
- 'tj.##rili.com':80
TCP:
Запросы HTTP GET:
- in#.###ol.sina.com.cn/iplookup/iplookup.php?fo#########
- up####.zmrili.com/update/update.php?ve#################
- tj.##rili.com/id=000000000001&os=2600&ver=0.2.14.822&proc=;System;smss.exe;csrss.exe;winlogon.exe;services.exe;lsass.exe;svchost.exe;svchost.exe;svchost.exe;svchost.exe;svchost.exe;explorer.exe;spoolsv.exe;ctfmon.exe;<Служебное имя>Log.exe;alg.exe;360tray.exe;ageofconan.exe;aion.exe;ash.exe;ashAvast.exe;ashAvSrv.exe;avgcc.exe;AVGCC32.EXE;AVGCTRL.EXE;AVP.COM;AVP.EXE;AVP32.EXE;AVPCC.EXE;AVPM.EXE;AVSYNMGR.EXE;bdagent.exe;bdss.exe;bdsubmit.exe;ClamWin.exe;drweb.exe;Drweb32w.exe;drweb386.exe;Drwebupw.exe;Drwebwcl.exe;ecmd.exe;egni.exe;ekrn.exe;fsav.exe;fsav32.exe;fsavaui.exe;fsavgui.exe;GUARD.EXE;mpftray.exe;NAVAPW32.EXE;netxray.exe;nod.exe;nod32.exe;outpost.exe;spidernt.exe;zapro.exe;ZONEALARM.EXE;bankcl.exe;BBClient.exe;bc_loader.exe;bclient.exe;bk.exe;cbank.exe;cbmain.ex;cbmain.exe;cbsmain.exe;clbank.exe;client7.exe;clmain.exe;clntw32.exe;contactNG.exe;el_cli.ex;elbank.exe;inbank-start-ff.exe;intpro.exe;iscc.exe;ISClient.exe;kb_cli.ex;kb_cli.exe;loadmain.exe;oncbcli.exe;rclient.exe;sgbclient.exe;startclient7.exe;tiny.exe;translink.exe;UniStream.exe;wclnt.exe;webmoney.exe;chrome.exe;firefox.exe;iexplore.exe;opera.exe;safari.exe;cabalmain.exe;ccapp.exe;dekaron.exe;dnf.exe;elementclient.exe;gc.exe;ge.exe;GVOnline.bin;gw.exe;httplook.exe;InphaseNXD.exe;l2.bin;lin.bin;lotroclient.exe;magent.exe;maplestory.exe;MCAGENT.EXE;Mir3Game.exe;Ragexe.exe;RagFree.exe;smc.exe;so3d.exe;sro_client.exe;TwelveSky2.exe;winbaram.exe;woool.exe;wow.exe;ybclient.exe;zlclient.exe;googletalk.exe;ICQ.exe;miranda32.exe;msn6.exe;msnmsgr.exe;pidgin.exe;qip.exe;skype.exe;trillian.exe;wsm.exe;YahooMessenger.exe;java.exe;javaw.exe;ntvdm.exe;putty.exe;__cd75efb816b2cc__.exe;ZZ__cd75efb816b2cc__.exe;thp.exe;cmd.exe;<Служебное имя>.exe;cscript.exe;WindowsKiller.exe;<Служебное имя>.exe;<Служебное имя>.exe;<Служебное имя>.exe
UDP:
- DNS ASK up####.zmrili.com
- DNS ASK in#.###ol.sina.com.cn
- DNS ASK www.ba##u.com
- DNS ASK tj.##rili.com
Другое:
Ищет следующие окна:
- ClassName: 'TrayNotifyWnd' WindowName: ''
- ClassName: 'TrayClockWClass' WindowName: ''
- ClassName: 'CalendarMain' WindowName: 'CalendarMain'
- ClassName: 'Shell_TrayWnd' WindowName: ''
