Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Name Resolution COM Defender Workstation' = '<SYSTEM32>\zarconudf.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Config Intelligent Now Accounts] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Config Intelligent Now Accounts] 'ImagePath' = '<SYSTEM32>\zarconudf.exe'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Modifies file system:
Creates the following files:
- <SYSTEM32>\wvsczpty\tst
- %TEMP%\zlebhubk6yviht3bvjdt07b.exe
- <SYSTEM32>\zarconudf.exe
- <SYSTEM32>\ubskloytn.exe
- <SYSTEM32>\wvsczpty\rng
- <SYSTEM32>\wvsczpty\run
- <SYSTEM32>\wvsczpty\cfg
- %WINDIR%\Temp\zlebhusfzjgbht3b.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\zarconudf.exe
- <SYSTEM32>\ubskloytn.exe
Deletes the following files:
- %TEMP%\zlebhubk6yviht3bvjdt07b.exe
- %WINDIR%\Temp\zlebhusfzjgbht3b.exe
Network activity:
Connects to:
- '18#.#17.73.77':80
- '18#.#06.120.168':80
- 'ri###nstorm.net':80
- 'lo####thepings.ru':80
- 'fa###cook.ru':80
- 'fa###cook.net':80
- 'ri###een.net':80
- 'fa###next.net':80
- 'ri###ext.net':80
- 'fa###been.net':80
- 'so###again.ru':80
- 'fi###again.net':80
- 'so###again.net':80
TCP:
HTTP GET requests:
- http://18#.#17.73.77/index.php
- http://18#.#06.120.168/index.php
- http://ri###nstorm.net/index.php
- http://lo####thepings.ru/index.php
- http://fa###cook.ru/index.php
- http://fa###cook.net/index.php
- http://ri###een.net/index.php
- http://fa###next.net/index.php
- http://ri###ext.net/index.php
- http://fa###been.net/index.php
- http://so###again.ru/index.php
- http://fi###again.net/index.php
- http://so###again.net/index.php
UDP:
- DNS ASK fa###aily.net
- DNS ASK wa###ull.net
- DNS ASK ta###ull.net
- DNS ASK tr###hold.net
- DNS ASK yo###old.net
- DNS ASK tr###second.ru
- DNS ASK tr###second.net
- DNS ASK yo###econd.net
- DNS ASK tr###ocean.net
- DNS ASK yo###cean.net
- DNS ASK tr###have.net
- DNS ASK yo##have.ru
- DNS ASK fi###econd.net
- DNS ASK yo###ave.net
- DNS ASK vi###old.net
- DNS ASK lr###second.net
- DNS ASK vi###econd.net
- DNS ASK lr###ocean.ru
- DNS ASK lr###ocean.net
- DNS ASK vi###cean.net
- DNS ASK lr###have.net
- DNS ASK vi###ave.net
- DNS ASK pl###hold.net
- DNS ASK fi##hold.ru
- DNS ASK pl###second.net
- DNS ASK ta##lose.ru
- DNS ASK ta###ose.net
- DNS ASK lr###hold.net
- DNS ASK fi###old.net
- DNS ASK wa###aily.net
- DNS ASK fa###ull.net
- DNS ASK we###lood.net
- DNS ASK ve###lood.ru
- DNS ASK ve###lood.net
- DNS ASK we###aily.net
- DNS ASK ve###aily.net
- DNS ASK we###ose.net
- DNS ASK ve###ose.net
- DNS ASK we##full.ru
- DNS ASK we###ull.net
- DNS ASK ve###ull.net
- DNS ASK pi###blood.net
- DNS ASK mu###lood.net
- DNS ASK pi###daily.net
- DNS ASK mu###aily.ru
- DNS ASK mu###aily.net
- DNS ASK pi###lose.net
- DNS ASK mu###ose.net
- DNS ASK pi###full.net
- DNS ASK mu###ull.net
- DNS ASK wa###lood.ru
- DNS ASK wa###lood.net
- DNS ASK ta###lood.net
- DNS ASK ta###aily.net
- DNS ASK fa###ose.net
- DNS ASK wa###ose.net
- DNS ASK fa###stand.net
- DNS ASK pl###ocean.net
- DNS ASK we###ave.net
- DNS ASK ve###ave.net
- DNS ASK mu###old.net
- DNS ASK pi###second.net
- DNS ASK mu###econd.net
- DNS ASK pi###ocean.ru
- DNS ASK pi###ocean.net
- DNS ASK mu###cean.net
- DNS ASK mu###ave.net
- DNS ASK pi###have.net
- DNS ASK wa###old.net
- DNS ASK ta##hold.ru
- DNS ASK pl###have.ru
- DNS ASK wa###econd.net
- DNS ASK ta###econd.net
- DNS ASK wa###cean.net
- DNS ASK ta###cean.net
- DNS ASK wa##have.ru
- DNS ASK wa###ave.net
- DNS ASK ta###ave.net
- DNS ASK tr###there.net
- DNS ASK yo###here.net
- DNS ASK tr###arms.net
- DNS ASK yo##arms.ru
- DNS ASK ve##have.ru
- DNS ASK we###cean.net
- DNS ASK pi###hold.net
- DNS ASK ve###cean.net
- DNS ASK ve###econd.net
- DNS ASK fi###cean.net
- DNS ASK fi###ave.net
- DNS ASK le###hold.net
- DNS ASK se###hold.net
- DNS ASK se###second.net
- DNS ASK le###second.ru
- DNS ASK le###second.net
- DNS ASK se###ocean.net
- DNS ASK le###ocean.net
- DNS ASK se###have.net
- DNS ASK le###have.net
- DNS ASK to###ose.net
- DNS ASK to##hold.ru
- DNS ASK to###ull.net
- DNS ASK fa###old.net
- DNS ASK fa###econd.net
- DNS ASK to###cean.net
- DNS ASK fa###cean.ru
- DNS ASK fa###cean.net
- DNS ASK to###ave.net
- DNS ASK fa###ave.net
- DNS ASK we###old.net
- DNS ASK ve###old.net
- DNS ASK we###econd.ru
- DNS ASK we###econd.net
- DNS ASK to###old.net
- DNS ASK pl###have.net
- DNS ASK to###econd.net
- DNS ASK to##lose.ru
- DNS ASK tr###stone.net
- DNS ASK to###aily.net
- DNS ASK li###tand.net
- DNS ASK ta###pass.net
- DNS ASK li###ugar.net
- DNS ASK fe###ugar.net
- DNS ASK so###sugar.net
- DNS ASK fe###ugar.ru
- DNS ASK li###tand.ru
- DNS ASK fe###gain.net
- DNS ASK we###ugar.net
- DNS ASK th###sugar.net
- DNS ASK ta###sugar.net
- DNS ASK le###ugar.net
- DNS ASK ta###stand.ru
- DNS ASK ta###stand.net
- DNS ASK le###tand.net
- DNS ASK po###again.net
- DNS ASK ca###gain.net
- DNS ASK po###pass.net
- DNS ASK ca##pass.ru
- DNS ASK ca###ass.net
- DNS ASK po###sugar.net
- DNS ASK ca###ugar.net
- DNS ASK po###stand.net
- DNS ASK fi###sugar.ru
- DNS ASK we###gain.net
- DNS ASK th###pass.ru
- DNS ASK we###ass.net
- DNS ASK so###stand.net
- DNS ASK li###ass.net
- DNS ASK lo####thepings.ru
- DNS ASK fa###cook.ru
- DNS ASK fa###cook.net
- DNS ASK ri###een.net
- DNS ASK fa###next.net
- DNS ASK ri###ext.net
- DNS ASK fa###been.net
- DNS ASK so###again.ru
- DNS ASK fi###again.net
- DNS ASK so###again.net
- DNS ASK so###pass.net
- DNS ASK ca###tand.net
- DNS ASK yo###rms.net
- DNS ASK fi###pass.net
- DNS ASK fe###ass.net
- DNS ASK le###ass.net
- DNS ASK th###again.net
- DNS ASK we###tand.net
- DNS ASK fi###stand.net
- DNS ASK fi###sugar.net
- DNS ASK le###gain.net
- DNS ASK li###gain.net
- DNS ASK ta###again.net
- DNS ASK le###gain.ru
- DNS ASK th###stand.net
- DNS ASK ri###nstorm.net
- DNS ASK fe###tand.net
- DNS ASK ta###old.net
- DNS ASK no###gain.ru
- DNS ASK li###ugar.ru
- DNS ASK pl###blood.ru
- DNS ASK vi###ull.net
- DNS ASK pl###blood.net
- DNS ASK fi###lood.net
- DNS ASK pl###daily.net
- DNS ASK fi###aily.net
- DNS ASK pl###lose.net
- DNS ASK fi###ose.net
- DNS ASK fi##lose.ru
- DNS ASK pl###full.net
- DNS ASK th###pass.net
- DNS ASK fi###ull.net
- DNS ASK le###blood.net
- DNS ASK se###daily.ru
- DNS ASK se###daily.net
- DNS ASK le###daily.net
- DNS ASK se###lose.net
- DNS ASK le###lose.net
- DNS ASK se###full.net
- DNS ASK le###full.ru
- DNS ASK le###full.net
- DNS ASK to###lood.net
- DNS ASK fa###lood.net
- DNS ASK lr###lose.net
- DNS ASK se###blood.net
- DNS ASK lr###full.net
- DNS ASK vi###ose.net
- DNS ASK vi###aily.net
- DNS ASK vi###aily.ru
- DNS ASK no###tand.net
- DNS ASK we##pass.ru
- DNS ASK no###tand.ru
- DNS ASK ri###gain.net
- DNS ASK fa###again.net
- DNS ASK ri###ass.net
- DNS ASK fa###pass.net
- DNS ASK ri###ugar.ru
- DNS ASK ri###ugar.net
- DNS ASK fa###sugar.net
- DNS ASK no###gain.net
- DNS ASK ri###tand.net
- DNS ASK no###ass.net
- DNS ASK tr###blood.net
- DNS ASK yo###lood.net
- DNS ASK tr###daily.net
- DNS ASK yo###aily.net
- DNS ASK tr###lose.net
- DNS ASK yo###ose.net
- DNS ASK tr###full.ru
- DNS ASK tr###full.net
- DNS ASK yo###ull.net
- DNS ASK lr###blood.net
- DNS ASK vi###lood.net
- DNS ASK no###ugar.net
- DNS ASK lr###daily.net
- DNS ASK yo###lood.ru
- '23#.#55.255.250':1900
Miscellaneous:
Creates and executes the following:
- '%TEMP%\zlebhubk6yviht3bvjdt07b.exe'
- '<SYSTEM32>\zarconudf.exe'
- '<SYSTEM32>\ubskloytn.exe' "<SYSTEM32>\zarconudf.exe"
- '%WINDIR%\Temp\zlebhusfzjgbht3b.exe' -r 40184 tcp