Technical Information
To ensure autorun and distribution:
Substitutes the following executable system files:
- <SYSTEM32>\setup.exe with <SYSTEM32>\Setup.exe
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\Setup.exe' (downloaded from the Internet)
Modifies file system :
Deletes the following files:
- <SYSTEM32>\setup.exe
Network activity:
Connects to:
- 'www.zh###an99.com':80
TCP:
HTTP GET requests:
- www.zh###an99.com/log.jpg
UDP:
- DNS ASK www.zh###an99.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'ZElementClient Window' WindowName: 'Element Client'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'msctls_updown32' WindowName: ''
