Trojan.Inject3.9563

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Classes\zpro_auto\shell\open\command] '' = '"<Full path to file>" "%1"'

Malicious functions:

Searches for windows to

detect analytical utilities:

ClassName: 'FileMonClass', WindowName: ''
ClassName: 'RegMonClass', WindowName: ''
ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''

Modifies file system:

Creates the following files:

%ALLUSERSPROFILE%\Application Data\TEMP:6056D91C
<Current directory>\log\servers\Detroit.txt
%TEMP%\aut4B.tmp
<Current directory>\log\servers\El Paso.txt
%TEMP%\aut4C.tmp
<Current directory>\log\servers\Fort Worth.txt
%TEMP%\aut4D.tmp
<Current directory>\log\servers\Hong Kong.txt
%TEMP%\aut4E.tmp
<Current directory>\log\servers\Houston.txt
%TEMP%\aut4F.tmp
<Current directory>\log\servers\Denver.txt
%TEMP%\aut4A.tmp
<Current directory>\log\servers\Huntington Beach.txt
%TEMP%\aut51.tmp
<Current directory>\log\servers\Jakarta.txt
%TEMP%\aut52.tmp
<Current directory>\log\servers\Kansas City.txt
%TEMP%\aut53.tmp
<Current directory>\log\servers\Las Vegas.txt
%TEMP%\aut54.tmp
<Current directory>\log\servers\Lima.txt
%TEMP%\aut55.tmp
<Current directory>\log\servers\London.txt
%TEMP%\aut50.tmp
<Current directory>\log\servers\Jacksonville.txt
%TEMP%\aut49.tmp
<Current directory>\log\servers\Delhi.txt
%TEMP%\aut48.tmp
%TEMP%\aut3C.tmp
<Current directory>\log\servers\Baltimore.txt
%TEMP%\aut3D.tmp
<Current directory>\log\servers\Barcelona.txt
%TEMP%\aut3E.tmp
<Current directory>\log\servers\Berlin.txt
%TEMP%\aut3F.tmp
<Current directory>\log\servers\Boston.txt
%TEMP%\aut40.tmp
<Current directory>\log\servers\Buenos Aires.txt
%TEMP%\aut41.tmp
<Current directory>\log\servers\Austin.txt
<Current directory>\log\servers\Cape Town.txt
<Current directory>\log\servers\Charlotte.txt
%TEMP%\aut43.tmp
<Current directory>\log\servers\Chicago.txt
%TEMP%\aut44.tmp
<Current directory>\log\servers\Cleveland.txt
%TEMP%\aut45.tmp
<Current directory>\log\servers\Colorado Springs.txt
%TEMP%\aut46.tmp
<Current directory>\log\servers\Columbus.txt
%TEMP%\aut47.tmp
<Current directory>\log\servers\Dallas.txt
%TEMP%\aut42.tmp
%TEMP%\aut56.tmp
<Current directory>\log\servers\Louisville.txt
%TEMP%\aut57.tmp
<Current directory>\log\servers\Madrid.txt
<Current directory>\log\servers\Raleigh.txt
%TEMP%\aut67.tmp
<Current directory>\log\servers\Rome.txt
%TEMP%\aut68.tmp
<Current directory>\log\servers\Sacramento.txt
%TEMP%\aut69.tmp
<Current directory>\log\servers\San Jose.txt
%TEMP%\aut6A.tmp
<Current directory>\log\servers\Seattle.txt
%TEMP%\aut6B.tmp
<Current directory>\log\servers\Seoul.txt
%TEMP%\aut6C.tmp
<Current directory>\log\servers\Shanghai.txt
%TEMP%\aut6D.tmp
<Current directory>\log\servers\St Louis.txt
%TEMP%\aut6E.tmp
<Current directory>\log\servers\Sydney.txt
%TEMP%\aut6F.tmp
<Current directory>\log\servers\Tokyo.txt
%TEMP%\aut70.tmp
<Current directory>\log\servers\Tucson.txt
%TEMP%\aut71.tmp
<Current directory>\log\servers\Tulsa.txt
%TEMP%\aut72.tmp
<Current directory>\log\servers\Valencia.txt
%TEMP%\aut66.tmp
%TEMP%\aut65.tmp
<Current directory>\log\servers\Portland.txt
<Current directory>\log\servers\Phoenix.txt
%TEMP%\aut58.tmp
<Current directory>\log\servers\Manila.txt
%TEMP%\aut59.tmp
<Current directory>\log\servers\Memphis.txt
%TEMP%\aut5A.tmp
<Current directory>\log\servers\Miami.txt
%TEMP%\aut5B.tmp
<Current directory>\log\servers\Milwaukee.txt
%TEMP%\aut5C.tmp
<Current directory>\log\servers\Minneapolis.txt
%TEMP%\aut5D.tmp
<Current directory>\log\servers\Moscow.txt
%TEMP%\aut5E.tmp
<Current directory>\log\servers\Nashville.txt
%TEMP%\aut5F.tmp
<Current directory>\log\servers\New Orleans.txt
%TEMP%\aut60.tmp
<Current directory>\log\servers\New York.txt
%TEMP%\aut61.tmp
<Current directory>\log\servers\Oakland.txt
%TEMP%\aut62.tmp
<Current directory>\log\servers\Paris.txt
%TEMP%\aut63.tmp
<Current directory>\log\servers\Philadelphia.txt
%TEMP%\aut64.tmp
%TEMP%\aut73.tmp
%TEMP%\aut3B.tmp
<Current directory>\log\servers\Atlantic City.txt
%TEMP%\aut3A.tmp
%TEMP%\aut11.tmp
<Current directory>\data\bmp\popup_pokerbar.bmp
%TEMP%\aut12.tmp
<Current directory>\data\bmp\popup_profile.bmp
%TEMP%\aut13.tmp
<Current directory>\data\bmp\popup_reconnect.bmp
%TEMP%\aut14.tmp
<Current directory>\data\bmp\popup_requests.bmp
%TEMP%\aut15.tmp
<Current directory>\data\bmp\popup_table.bmp
%TEMP%\aut10.tmp
<Current directory>\data\bmp\popup_lottery.bmp
%TEMP%\aut16.tmp
<Current directory>\data\bmp\popup_vipclub.bmp
%TEMP%\aut18.tmp
<Current directory>\data\bmp\popup_x.bmp
%TEMP%\aut19.tmp
<Current directory>\data\bmp\reboot.bmp
%TEMP%\aut1A.tmp
<Current directory>\data\bmp\seattaken.bmp
%TEMP%\aut1B.tmp
<Current directory>\data\bmp\stand_up.bmp
%TEMP%\aut1C.tmp
<Current directory>\data\bmp\popup_terms.bmp
%TEMP%\aut17.tmp
<Current directory>\data\bmp\popup_giftfriendslobby.bmp
%TEMP%\autF.tmp
<Current directory>\data\bmp\popup_friendstoplay.bmp
<Current directory>\BetaBot.zpro
%TEMP%\aut2.tmp
<Current directory>\settings.ini
%TEMP%\aut3.tmp
<Current directory>\bot.ico
%TEMP%\aut4.tmp
<Current directory>\data\card.ini
%TEMP%\aut5.tmp
<Current directory>\data\changed.ini
%TEMP%\aut6.tmp
<Current directory>\data\chat.txt
%TEMP%\aut1.tmp
%TEMP%\aut7.tmp
%TEMP%\aut8.tmp
<Current directory>\data\suit.ini
%TEMP%\aut9.tmp
<Current directory>\data\table.txt
%TEMP%\autB.tmp
<Current directory>\data\version.txt
%TEMP%\autC.tmp
<Current directory>\data\action\action.ini
%TEMP%\autD.tmp
<Current directory>\data\bmp\popup_doitlater.bmp
%TEMP%\autE.tmp
<Current directory>\data\playturn.ini
<Current directory>\data\bmp\table_buyin.bmp
%TEMP%\aut1D.tmp
<Current directory>\data\opponent\changed.ini
%TEMP%\aut1E.tmp
%TEMP%\aut2D.tmp
<Current directory>\includes\vendor\Tesseract\notes v2.04.txt
%TEMP%\aut2E.tmp
<Current directory>\includes\vendor\Tesseract\tesseract.exe
%TEMP%\aut2F.tmp
<Current directory>\includes\vendor\Tesseract\tessdata\eng.DangAmbigs
%TEMP%\aut30.tmp
<Current directory>\includes\vendor\Tesseract\tessdata\eng.freq-dawg
%TEMP%\aut31.tmp
<Current directory>\includes\vendor\Tesseract\tessdata\eng.inttemp
%TEMP%\aut32.tmp
<Current directory>\includes\vendor\Tesseract\tessdata\eng.normproto
%TEMP%\aut33.tmp
<Current directory>\includes\vendor\Tesseract\tessdata\eng.pffmtable
%TEMP%\aut34.tmp
<Current directory>\includes\vendor\Tesseract\tessdata\eng.unicharset
%TEMP%\aut35.tmp
<Current directory>\includes\vendor\Tesseract\tessdata\eng.user-words
%TEMP%\aut36.tmp
<Current directory>\includes\vendor\Tesseract\tessdata\eng.word-dawg
%TEMP%\aut37.tmp
<Current directory>\log\servers\Albuquerque.txt
%TEMP%\aut38.tmp
<Current directory>\log\servers\AllServerLogs.txt
%TEMP%\aut39.tmp
<Current directory>\includes\vendor\PSIM\readme.txt
<Current directory>\includes\vendor\PSIM\psim.dll
%TEMP%\aut2C.tmp
%TEMP%\aut2B.tmp
<Current directory>\data\opponent\Green.ini
%TEMP%\aut1F.tmp
<Current directory>\data\opponent\Grey.ini
%TEMP%\aut20.tmp
<Current directory>\data\opponent\Newblue.ini
%TEMP%\aut21.tmp
<Current directory>\data\opponent\Oldblue.ini
%TEMP%\aut22.tmp
<Current directory>\data\opponent\Red.ini
%TEMP%\aut23.tmp
<Current directory>\data\server\serverlist.txt
%TEMP%\aut24.tmp
%TEMP%\zpb2011\curl.exe
%TEMP%\aut25.tmp
%TEMP%\zpb2011\chip.bmp
%TEMP%\aut26.tmp
<Current directory>\includes\vendor\CompInfo\readme.txt
%TEMP%\aut27.tmp
<Current directory>\includes\vendor\FileListToArray\readme.txt
%TEMP%\aut28.tmp
<Current directory>\includes\vendor\FindBMP\readme.txt
%TEMP%\aut29.tmp
<Current directory>\includes\vendor\FindChecksum\readme.txt
%TEMP%\aut2A.tmp
<Current directory>\includes\vendor\HardwareHash\readme.txt
<Current directory>\log\servers\Atlanta.txt
<Current directory>\log\servers\Vancouver.txt

Deletes the following files:

%TEMP%\aut1.tmp
%TEMP%\aut54.tmp
%TEMP%\aut53.tmp
%TEMP%\aut52.tmp
%TEMP%\aut51.tmp
%TEMP%\aut50.tmp
%TEMP%\aut4F.tmp
%TEMP%\aut4E.tmp
%TEMP%\aut4D.tmp
%TEMP%\aut4C.tmp
%TEMP%\aut4B.tmp
%TEMP%\aut4A.tmp
%TEMP%\aut56.tmp
%TEMP%\aut55.tmp
%TEMP%\aut47.tmp
%TEMP%\aut46.tmp
%TEMP%\aut45.tmp
%TEMP%\aut44.tmp
%TEMP%\aut43.tmp
%TEMP%\aut42.tmp
%TEMP%\aut41.tmp
%TEMP%\aut40.tmp
%TEMP%\aut3F.tmp
%TEMP%\aut3E.tmp
%TEMP%\aut3D.tmp
%TEMP%\aut49.tmp
%TEMP%\aut1E.tmp
%TEMP%\aut57.tmp
%TEMP%\aut71.tmp
%TEMP%\aut70.tmp
%TEMP%\aut6F.tmp
%TEMP%\aut6E.tmp
%TEMP%\aut6D.tmp
%TEMP%\aut6C.tmp
%TEMP%\aut6B.tmp
%TEMP%\aut6A.tmp
%TEMP%\aut69.tmp
%TEMP%\aut68.tmp
%TEMP%\aut67.tmp
%TEMP%\aut66.tmp
%TEMP%\aut65.tmp
%TEMP%\aut64.tmp
%TEMP%\aut63.tmp
%TEMP%\aut62.tmp
%TEMP%\aut61.tmp
%TEMP%\aut60.tmp
%TEMP%\aut5F.tmp
%TEMP%\aut5E.tmp
%TEMP%\aut5D.tmp
%TEMP%\aut5C.tmp
%TEMP%\aut5B.tmp
%TEMP%\aut5A.tmp
%TEMP%\aut59.tmp
%TEMP%\aut3C.tmp
%TEMP%\aut48.tmp
%TEMP%\aut3B.tmp
%TEMP%\aut3A.tmp
%TEMP%\aut39.tmp
%TEMP%\autF.tmp
%TEMP%\aut1A.tmp
%TEMP%\aut19.tmp
%TEMP%\aut18.tmp
%TEMP%\aut17.tmp
%TEMP%\aut16.tmp
%TEMP%\aut15.tmp
%TEMP%\aut14.tmp
%TEMP%\aut13.tmp
%TEMP%\aut12.tmp
%TEMP%\aut11.tmp
%TEMP%\aut10.tmp
%TEMP%\autE.tmp
%TEMP%\aut1C.tmp
%TEMP%\autD.tmp
%TEMP%\autC.tmp
%TEMP%\autB.tmp
%TEMP%\aut9.tmp
%TEMP%\aut8.tmp
%TEMP%\aut7.tmp
%TEMP%\aut6.tmp
%TEMP%\aut5.tmp
%TEMP%\aut4.tmp
%TEMP%\aut3.tmp
%TEMP%\aut2.tmp
%TEMP%\aut72.tmp
%TEMP%\aut58.tmp
%TEMP%\aut1D.tmp
%TEMP%\aut20.tmp
%TEMP%\aut1B.tmp
%TEMP%\aut38.tmp
%TEMP%\aut37.tmp
%TEMP%\aut36.tmp
%TEMP%\aut35.tmp
%TEMP%\aut34.tmp
%TEMP%\aut33.tmp
%TEMP%\aut32.tmp
%TEMP%\aut31.tmp
%TEMP%\aut30.tmp
%TEMP%\aut2F.tmp
%TEMP%\aut2E.tmp
%TEMP%\aut2D.tmp
%TEMP%\aut2C.tmp
%TEMP%\aut2B.tmp
%TEMP%\aut2A.tmp
%TEMP%\aut29.tmp
%TEMP%\aut28.tmp
%TEMP%\aut27.tmp
%TEMP%\aut26.tmp
%TEMP%\aut25.tmp
%TEMP%\aut24.tmp
%TEMP%\aut23.tmp
%TEMP%\aut22.tmp
%TEMP%\aut21.tmp
%TEMP%\aut1F.tmp
%TEMP%\aut73.tmp

Miscellaneous:

Creates and executes the following:

'<Full path to file>'

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней