Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\zguard watchdog (boot)
- <SYSTEM32>\tasks\zguard watchdog
- <SYSTEM32>\tasks\zguard pulse
- <SYSTEM32>\tasks\zguard exit
Modifies file system
Creates the following files
- <Current directory>\logs\2026-09\zguard_20260921.log
- <Current directory>\zguard_복구.bat
- %ALLUSERSPROFILE%\zguard\zguard_복구.bat
- %ALLUSERSPROFILE%\zguard\zguard_파수꾼.bat
- %ALLUSERSPROFILE%\zguard\인터넷이_안될때_읽으세요.txt
- %TEMP%\wpf\hagmzawb.khp
Deletes following files that it created itself
- %TEMP%\wpf\hagmzawb.khp
Network activity
Connects to
- 'zs###l.co.kr':443
UDP
- DNS ASK zs###l.co.kr
Miscellaneous
Executes the following
- '<SYSTEM32>\schtasks.exe' /Query /TN "zGuard Watchdog" /XML ONE
- '<SYSTEM32>\schtasks.exe' /Create /F /TN "zGuard Watchdog (Boot)" /TR "\"%ALLUSERSPROFILE%\zGuard\zGuard_파수꾼.bat\"" /RU SYSTEM /RL HIGHEST /SC ONSTART /DELAY 0000:20
- '<SYSTEM32>\schtasks.exe' /Create /F /TN "zGuard Watchdog" /TR "\"%ALLUSERSPROFILE%\zGuard\zGuard_파수꾼.bat\"" /RU SYSTEM /RL HIGHEST /SC MINUTE /MO 15
- '<SYSTEM32>\schtasks.exe' /Create /F /TN "zGuard Pulse" /TR "\"%ALLUSERSPROFILE%\zGuard\zGuardRescue.exe\" -pulse" /RL HIGHEST /SC MINUTE /MO 5
- '<SYSTEM32>\schtasks.exe' /Query /TN "zGuard 자동 실행" /XML ONE
- '<SYSTEM32>\schtasks.exe' /Query /TN "zGuard 자동 실행"
