Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\hitNzo20gkQ.exe
Malicious functions:
Executes the following:
- '<SYSTEM32>\svchost.exe' netsvcs
- '%WINDIR%\explorer.exe'
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
- %WINDIR%\Explorer.EXE
the following user processes:
- cbmain.ex
Modifies file system :
Creates the following files:
- %ALLUSERSPROFILE%\cbank\intpro\intpro.exe
- %ALLUSERSPROFILE%\cbank\inphasenxd\InphaseNXD.exe
- %ALLUSERSPROFILE%\cbank\iscc\iscc.exe
- %ALLUSERSPROFILE%\cbank\java\java.exe
- %ALLUSERSPROFILE%\cbank\isclient\ISClient.exe
- %ALLUSERSPROFILE%\cbank\httplook\httplook.exe
- %ALLUSERSPROFILE%\cbank\gw\gw.exe
- %ALLUSERSPROFILE%\cbank\icq\ICQ.exe
- %ALLUSERSPROFILE%\cbank\inbank-start-ff\inbank-start-ff.exe
- %ALLUSERSPROFILE%\cbank\iexplore\iexplore.exe
- %ALLUSERSPROFILE%\cbank\javaw\javaw.exe
- %ALLUSERSPROFILE%\cbank\magent\magent.exe
- %ALLUSERSPROFILE%\cbank\lotroclient\lotroclient.exe
- %ALLUSERSPROFILE%\cbank\maplestory\maplestory.exe
- %ALLUSERSPROFILE%\cbank\mir3game\Mir3Game.exe
- %ALLUSERSPROFILE%\cbank\mcagent\MCAGENT.EXE
- %ALLUSERSPROFILE%\cbank\kb_cli\kb_cli.exe
- %ALLUSERSPROFILE%\cbank\kb_cli\kb_cli.ex
- %ALLUSERSPROFILE%\cbank\l2\l2.bin
- %ALLUSERSPROFILE%\cbank\loadmain\loadmain.exe
- %ALLUSERSPROFILE%\cbank\lin\lin.bin
- %ALLUSERSPROFILE%\cbank\gvonline\GVOnline.bin
- %ALLUSERSPROFILE%\cbank\ecmd\ecmd.exe
- %ALLUSERSPROFILE%\cbank\drwebwcl\Drwebwcl.exe
- %ALLUSERSPROFILE%\cbank\egni\egni.exe
- %ALLUSERSPROFILE%\cbank\elbank\elbank.exe
- %ALLUSERSPROFILE%\cbank\ekrn\ekrn.exe
- %ALLUSERSPROFILE%\cbank\drweb\drweb.exe
- %ALLUSERSPROFILE%\cbank\dnf\dnf.exe
- %ALLUSERSPROFILE%\cbank\drweb32w\Drweb32w.exe
- %ALLUSERSPROFILE%\cbank\drwebupw\Drwebupw.exe
- %ALLUSERSPROFILE%\cbank\drweb386\drweb386.exe
- %ALLUSERSPROFILE%\cbank\elementclient\elementclient.exe
- %ALLUSERSPROFILE%\cbank\gc\gc.exe
- %ALLUSERSPROFILE%\cbank\fsavgui\fsavgui.exe
- %ALLUSERSPROFILE%\cbank\ge\ge.exe
- %ALLUSERSPROFILE%\cbank\guard\GUARD.EXE
- %ALLUSERSPROFILE%\cbank\googletalk\googletalk.exe
- %ALLUSERSPROFILE%\cbank\firefox\firefox.exe
- %ALLUSERSPROFILE%\cbank\el_cli\el_cli.ex
- %ALLUSERSPROFILE%\cbank\fsav\fsav.exe
- %ALLUSERSPROFILE%\cbank\fsavaui\fsavaui.exe
- %ALLUSERSPROFILE%\cbank\fsav32\fsav32.exe
- %ALLUSERSPROFILE%\cbank\twelvesky2\TwelveSky2.exe
- %ALLUSERSPROFILE%\cbank\trillian\trillian.exe
- %ALLUSERSPROFILE%\cbank\unistream\UniStream.exe
- %ALLUSERSPROFILE%\cbank\webmoney\webmoney.exe
- %ALLUSERSPROFILE%\cbank\wclnt\wclnt.exe
- %ALLUSERSPROFILE%\cbank\sro_client\sro_client.exe
- %ALLUSERSPROFILE%\cbank\spidernt\spidernt.exe
- %ALLUSERSPROFILE%\cbank\startclient7\startclient7.exe
- %ALLUSERSPROFILE%\cbank\translink\translink.exe
- %ALLUSERSPROFILE%\cbank\tiny\tiny.exe
- %ALLUSERSPROFILE%\cbank\winbaram\winbaram.exe
- %ALLUSERSPROFILE%\cbank\zlclient\zlclient.exe
- %ALLUSERSPROFILE%\cbank\zapro\zapro.exe
- %ALLUSERSPROFILE%\cbank\zonealarm\ZONEALARM.EXE
- %ALLUSERSPROFILE%\cbank\__cd75efb816b2cc__\__cd75efb816b2cc__.exe
- %ALLUSERSPROFILE%\cbank\zz__cd75efb816b2cc__\ZZ__cd75efb816b2cc__.exe
- %ALLUSERSPROFILE%\cbank\wow\wow.exe
- %ALLUSERSPROFILE%\cbank\woool\woool.exe
- %ALLUSERSPROFILE%\cbank\wsm\wsm.exe
- %ALLUSERSPROFILE%\cbank\ybclient\ybclient.exe
- %ALLUSERSPROFILE%\cbank\yahoomessenger\YahooMessenger.exe
- %ALLUSERSPROFILE%\cbank\so3d\so3d.exe
- %ALLUSERSPROFILE%\cbank\nod\nod.exe
- %ALLUSERSPROFILE%\cbank\netxray\netxray.exe
- %ALLUSERSPROFILE%\cbank\nod32\nod32.exe
- %ALLUSERSPROFILE%\cbank\oncbcli\oncbcli.exe
- %ALLUSERSPROFILE%\cbank\ntvdm\ntvdm.exe
- %ALLUSERSPROFILE%\cbank\mpftray\mpftray.exe
- %ALLUSERSPROFILE%\cbank\miranda32\miranda32.exe
- %ALLUSERSPROFILE%\cbank\msn6\msn6.exe
- %ALLUSERSPROFILE%\cbank\navapw32\NAVAPW32.EXE
- %ALLUSERSPROFILE%\cbank\msnmsgr\msnmsgr.exe
- %ALLUSERSPROFILE%\cbank\opera\opera.exe
- %ALLUSERSPROFILE%\cbank\safari\safari.exe
- %ALLUSERSPROFILE%\cbank\rclient\rclient.exe
- %ALLUSERSPROFILE%\cbank\sgbclient\sgbclient.exe
- %ALLUSERSPROFILE%\cbank\smc\smc.exe
- %ALLUSERSPROFILE%\cbank\skype\skype.exe
- %ALLUSERSPROFILE%\cbank\pidgin\pidgin.exe
- %ALLUSERSPROFILE%\cbank\outpost\outpost.exe
- %ALLUSERSPROFILE%\cbank\putty\putty.exe
- %ALLUSERSPROFILE%\cbank\ragfree\RagFree.exe
- %ALLUSERSPROFILE%\cbank\qip\qip.exe
- %ALLUSERSPROFILE%\cbank\dekaron\dekaron.exe
- %TEMP%\1D.tmp
- %TEMP%\1C.tmp
- %TEMP%\1E.tmp
- %TEMP%\20.tmp
- %TEMP%\1F.tmp
- %TEMP%\18.tmp
- %TEMP%\17.tmp
- %TEMP%\19.tmp
- %TEMP%\1B.tmp
- %TEMP%\1A.tmp
- %TEMP%\21.tmp
- %TEMP%\28.tmp
- %TEMP%\27.tmp
- %TEMP%\29.tmp
- %ALLUSERSPROFILE%\Application Data\4EUDycE7Fz0\jbE9cSHrBig.dat
- %ALLUSERSPROFILE%\Application Data\4EUDycE7Fz0\mnhslst32.dat
- %TEMP%\23.tmp
- %TEMP%\22.tmp
- %TEMP%\24.tmp
- %TEMP%\26.tmp
- %TEMP%\25.tmp
- %TEMP%\16.tmp
- %TEMP%\7.tmp
- %TEMP%\6.tmp
- %TEMP%\8.tmp
- %TEMP%\A.tmp
- %TEMP%\9.tmp
- %TEMP%\2.tmp
- %TEMP%\1.tmp
- %TEMP%\3.tmp
- %TEMP%\5.tmp
- %TEMP%\4.tmp
- %TEMP%\B.tmp
- %TEMP%\12.tmp
- %TEMP%\11.tmp
- %TEMP%\13.tmp
- %TEMP%\15.tmp
- %TEMP%\14.tmp
- %TEMP%\D.tmp
- %TEMP%\C.tmp
- %TEMP%\E.tmp
- %TEMP%\10.tmp
- %TEMP%\F.tmp
- %ALLUSERSPROFILE%\cbank\bdsubmit\bdsubmit.exe
- %ALLUSERSPROFILE%\cbank\bdss\bdss.exe
- %ALLUSERSPROFILE%\cbank\bk\bk.exe
- %ALLUSERSPROFILE%\cbank\cbank\cbank.exe
- %ALLUSERSPROFILE%\cbank\cabalmain\cabalmain.exe
- %ALLUSERSPROFILE%\cbank\bbclient\BBClient.exe
- %ALLUSERSPROFILE%\cbank\bankcl\bankcl.exe
- %ALLUSERSPROFILE%\cbank\bclient\bclient.exe
- %ALLUSERSPROFILE%\cbank\bdagent\bdagent.exe
- %ALLUSERSPROFILE%\cbank\bc_loader\bc_loader.exe
- %ALLUSERSPROFILE%\cbank\cbmain\cbmain.ex
- %ALLUSERSPROFILE%\cbank\client7\client7.exe
- %ALLUSERSPROFILE%\cbank\clbank\clbank.exe
- %ALLUSERSPROFILE%\cbank\clmain\clmain.exe
- %ALLUSERSPROFILE%\cbank\contactng\contactNG.exe
- %ALLUSERSPROFILE%\cbank\clntw32\clntw32.exe
- %ALLUSERSPROFILE%\cbank\cbsmain\cbsmain.exe
- %ALLUSERSPROFILE%\cbank\cbmain\cbmain.exe
- %ALLUSERSPROFILE%\cbank\ccapp\ccapp.exe
- %ALLUSERSPROFILE%\cbank\clamwin\ClamWin.exe
- %ALLUSERSPROFILE%\cbank\chrome\chrome.exe
- %ALLUSERSPROFILE%\cbank\avsynmgr\AVSYNMGR.EXE
- %ALLUSERSPROFILE%\cbank\ashavsrv\ashAvSrv.exe
- %ALLUSERSPROFILE%\cbank\ashavast\ashAvast.exe
- %TEMP%\2B.tmp
- %ALLUSERSPROFILE%\cbank\avgcc32\AVGCC32.EXE
- %ALLUSERSPROFILE%\cbank\avgcc\avgcc.exe
- %ALLUSERSPROFILE%\cbank\ageofconan\ageofconan.exe
- %ALLUSERSPROFILE%\cbank\360tray\360tray.exe
- %ALLUSERSPROFILE%\cbank\aion\aion.exe
- %TEMP%\2A.tmp
- %ALLUSERSPROFILE%\cbank\ash\ash.exe
- %TEMP%\2C.tmp
- %ALLUSERSPROFILE%\cbank\avp32\AVP32.EXE
- %TEMP%\2F.tmp
- %TEMP%\30.tmp
- %ALLUSERSPROFILE%\cbank\avpm\AVPM.EXE
- %ALLUSERSPROFILE%\cbank\avpcc\AVPCC.EXE
- %TEMP%\2D.tmp
- %ALLUSERSPROFILE%\cbank\avgctrl\AVGCTRL.EXE
- %ALLUSERSPROFILE%\cbank\avp\AVP.COM
- %ALLUSERSPROFILE%\cbank\avp\AVP.EXE
- %TEMP%\2E.tmp
Sets the 'hidden' attribute to the following files:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\hitNzo20gkQ.exe
Deletes the following files:
- %TEMP%\1.tmp
- %TEMP%\21.tmp
- %TEMP%\20.tmp
- %TEMP%\24.tmp
- %TEMP%\23.tmp
- %TEMP%\22.tmp
- %TEMP%\1C.tmp
- %TEMP%\1B.tmp
- %TEMP%\1A.tmp
- %TEMP%\1F.tmp
- %TEMP%\1E.tmp
- %TEMP%\1D.tmp
- %TEMP%\2D.tmp
- %TEMP%\2C.tmp
- %TEMP%\2B.tmp
- %TEMP%\30.tmp
- %TEMP%\2F.tmp
- %TEMP%\2E.tmp
- %TEMP%\27.tmp
- %TEMP%\26.tmp
- %TEMP%\25.tmp
- %TEMP%\2A.tmp
- %TEMP%\29.tmp
- %TEMP%\28.tmp
- %TEMP%\A.tmp
- %TEMP%\9.tmp
- %TEMP%\8.tmp
- %TEMP%\D.tmp
- %TEMP%\C.tmp
- %TEMP%\B.tmp
- %TEMP%\4.tmp
- %TEMP%\3.tmp
- %TEMP%\2.tmp
- %TEMP%\7.tmp
- %TEMP%\6.tmp
- %TEMP%\5.tmp
- %TEMP%\16.tmp
- %TEMP%\15.tmp
- %TEMP%\14.tmp
- %TEMP%\19.tmp
- %TEMP%\18.tmp
- %TEMP%\17.tmp
- %TEMP%\10.tmp
- %TEMP%\F.tmp
- %TEMP%\E.tmp
- %TEMP%\13.tmp
- %TEMP%\12.tmp
- %TEMP%\11.tmp
Deletes itself.
Network activity:
Connects to:
- 'localhost':700
- 'de##2u.info':80
- 'a.#om':80
UDP:
- DNS ASK de##2u.info
- DNS ASK a.#om
Miscellaneous:
Searches for the following windows:
- ClassName: 'OperaWindowClass' WindowName: '(null)'
- ClassName: 'Chrome_WidgetWin_0' WindowName: '(null)'
- ClassName: 'MozillaWindowClass' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'IEFrame' WindowName: '(null)'