Technical Information
To ensure autorun and distribution:
Creates the following files on removable media:
- <Drive name for removable media>:\Program Files\zsjh\dz1.ini
- <Drive name for removable media>:\Program Files\zsjh\dz.ini
Modifies file system:
Creates the following files:
- <Current directory>\ЧкКЇПµБРИнјю№Щ·ЅПВФШТі.url
Sets the 'hidden' attribute to the following files:
- <Drive name for removable media>:\Program Files\zsjh\dz1.ini
- <Drive name for removable media>:\Program Files\zsjh\dz.ini
Network activity:
Connects to:
- 'bb#.uc.cn':80
- '12#.#25.114.144':80
- '11#.#9.87.115':22345
- '11#.#9.87.115':80
- 'localhost':1042
- 'zs##88.com':80
- 'ch###.cp.360.cn':80
- 'tr###.#aipiao.163.com':80
- 'bn##8.com':443
- 'bn##6.com':443
TCP:
HTTP GET requests:
- http://bb#.uc.cn/home.php?mo##################
- http://www.ba##u.com/ via 12#.#25.114.144
- http://11#.#9.87.115/uploads/soft/config1.xml
- http://11#.#9.87.115/uploads/soft/config.xml
- http://www.zs##88.com/ via zs##88.com
- http://ch###.cp.360.cn/zst/getchartdata?lo################################################################
- http://tr###.#aipiao.163.com/x3d/?pe##############
UDP:
- DNS ASK bb#.uc.cn
- DNS ASK www.ba##u.com
- DNS ASK www.zs##88.com
- DNS ASK ch###.cp.360.cn
- DNS ASK tr###.#aipiao.163.com
- DNS ASK www.bn##8.com
- DNS ASK www.bn##6.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
