Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\zkPlatweb\shell\open\command] '' = '"%PROGRAM_FILES%\zkPlat\zkPlatAp.exe" "%1"'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\zkPlat\czwCheck.exe' = '%PROGRAM_FILES%\zkPlat\czwCheck.exe:*:Enabled:czwCheck'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\zkPlat\zkPlat.exe' = '%PROGRAM_FILES%\zkPlat\zkPlat.exe:*:Enabled:ХЫїЫЖЅМЁНш'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\zkPlat\zkPlatAp.exe' = '%PROGRAM_FILES%\zkPlat\zkPlatAp.exe:*:Enabled:ХЫїЫЖЅМЁНш App'
Creates and executes the following:
- '%PROGRAM_FILES%\zkPlat\zkPlatAp.exe'
- '%TEMP%\is-1TQ00.tmp\<Virus name>_install.tmp' /SL5="$30092,1818781,136192,<Current directory>\<Virus name>_install.exe" /VERYSILENT
- '<Current directory>\<Virus name>_install.exe' /VERYSILENT
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\zkPlat\is-6PASF.tmp
- %PROGRAM_FILES%\zkPlat\is-6P45N.tmp
- %PROGRAM_FILES%\zkPlat\is-H98MF.tmp
- %PROGRAM_FILES%\zkPlat\plugins\is-RTP88.tmp
- %PROGRAM_FILES%\zkPlat\config\is-2JJ1N.tmp
- %PROGRAM_FILES%\zkPlat\is-HFKL6.tmp
- %PROGRAM_FILES%\zkPlat\is-QDFIA.tmp
- %PROGRAM_FILES%\zkPlat\is-NT5IR.tmp
- %PROGRAM_FILES%\zkPlat\is-5TCJD.tmp
- %PROGRAM_FILES%\zkPlat\is-I5NJD.tmp
- %HOMEPATH%\Desktop\zkPlat sale.lnk
- %PROGRAM_FILES%\zkPlat\config\config.ini
- %PROGRAM_FILES%\zkPlat\config\oper.bmx
- %PROGRAM_FILES%\zkPlat\config\CfgTmp.zip
- %PROGRAM_FILES%\zkPlat\top_box.bmp
- %PROGRAM_FILES%\zkPlat\plugins\is-RD9RT.tmp
- %PROGRAM_FILES%\zkPlat\plugins\is-CNSG5.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\zkPlat\zkPlat sale.lnk
- %PROGRAM_FILES%\zkPlat\unins000.dat
- %ALLUSERSPROFILE%\Start Menu\Programs\zkPlat\Uninstall ХЫїЫЖЅМЁНш.lnk
- %TEMP%\is-SN9F2.tmp\MgRecommend.dll
- %TEMP%\is-SN9F2.tmp\myStat.dll
- %TEMP%\is-SN9F2.tmp\setup.jpg
- %TEMP%\is-SN9F2.tmp\top_box.jpg
- %TEMP%\is-SN9F2.tmp\left_box.bmp
- %TEMP%\is-1TQ00.tmp\<Virus name>_install.tmp
- <Current directory>\<Virus name>_install.exe
- %TEMP%\is-SN9F2.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-SN9F2.tmp\jpg2bmp.dll
- %TEMP%\is-SN9F2.tmp\_isetup\_shfoldr.dll
- %PROGRAM_FILES%\zkPlat\is-IFI3L.tmp
- %PROGRAM_FILES%\zkPlat\is-5FKPE.tmp
- %PROGRAM_FILES%\zkPlat\is-791GU.tmp
- %PROGRAM_FILES%\zkPlat\is-HQ12V.tmp
- %PROGRAM_FILES%\zkPlat\is-DC6MI.tmp
- %TEMP%\is-SN9F2.tmp\top_box.bmp
- %TEMP%\is-SN9F2.tmp\setup.bmp
- %PROGRAM_FILES%\zkPlat\is-ENE0M.tmp
- %PROGRAM_FILES%\zkPlat\is-522UR.tmp
- %PROGRAM_FILES%\zkPlat\is-I9JN6.tmp
Deletes the following files:
- %TEMP%\is-SN9F2.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-SN9F2.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-SN9F2.tmp\top_box.bmp
- %TEMP%\is-SN9F2.tmp\top_box.jpg
- %TEMP%\is-1TQ00.tmp\<Virus name>_install.tmp
- <Current directory>\<Virus name>_install.exe
- %PROGRAM_FILES%\zkPlat\config\CfgTmp.zip
- %PROGRAM_FILES%\zkPlat\config\init.config.ini
- %TEMP%\is-SN9F2.tmp\jpg2bmp.dll
- %TEMP%\is-SN9F2.tmp\left_box.bmp
- %PROGRAM_FILES%\zkPlat\zkPlat.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\tongji[1].html
- %TEMP%\is-SN9F2.tmp\setup.bmp
- %TEMP%\is-SN9F2.tmp\setup.jpg
- %TEMP%\is-SN9F2.tmp\MgRecommend.dll
- %TEMP%\is-SN9F2.tmp\myStat.dll
Moves the following files:
- from %PROGRAM_FILES%\zkPlat\is-6P45N.tmp to %PROGRAM_FILES%\zkPlat\sqlite3.dll
- from %PROGRAM_FILES%\zkPlat\is-6PASF.tmp to %PROGRAM_FILES%\zkPlat\zkPlat.exe
- from %PROGRAM_FILES%\zkPlat\is-5TCJD.tmp to %PROGRAM_FILES%\zkPlat\ppxa.dll
- from %PROGRAM_FILES%\zkPlat\is-NT5IR.tmp to %PROGRAM_FILES%\zkPlat\msvcr71.dll
- from %PROGRAM_FILES%\zkPlat\is-I5NJD.tmp to %PROGRAM_FILES%\zkPlat\myStat.dll
- from %PROGRAM_FILES%\zkPlat\plugins\is-CNSG5.tmp to %PROGRAM_FILES%\zkPlat\plugins\DtMgr.dll
- from %PROGRAM_FILES%\zkPlat\plugins\is-RD9RT.tmp to %PROGRAM_FILES%\zkPlat\plugins\MGeneral.dll
- from %PROGRAM_FILES%\zkPlat\plugins\is-RTP88.tmp to %PROGRAM_FILES%\zkPlat\plugins\dexp.dat
- from %PROGRAM_FILES%\zkPlat\is-H98MF.tmp to %PROGRAM_FILES%\zkPlat\zkPlatAp.exe
- from %PROGRAM_FILES%\zkPlat\config\is-2JJ1N.tmp to %PROGRAM_FILES%\zkPlat\config\init.config.ini
- from %PROGRAM_FILES%\zkPlat\is-5FKPE.tmp to %PROGRAM_FILES%\zkPlat\FSSaleurl.url
- from %PROGRAM_FILES%\zkPlat\is-IFI3L.tmp to %PROGRAM_FILES%\zkPlat\jpg2bmp.dll
- from %PROGRAM_FILES%\zkPlat\is-522UR.tmp to %PROGRAM_FILES%\zkPlat\czwCheck.exe
- from %PROGRAM_FILES%\zkPlat\is-ENE0M.tmp to %PROGRAM_FILES%\zkPlat\unins000.exe
- from %PROGRAM_FILES%\zkPlat\is-I9JN6.tmp to %PROGRAM_FILES%\zkPlat\zkPlat.exe
- from %PROGRAM_FILES%\zkPlat\is-QDFIA.tmp to %PROGRAM_FILES%\zkPlat\msvcp71.dll
- from %PROGRAM_FILES%\zkPlat\is-HFKL6.tmp to %PROGRAM_FILES%\zkPlat\msvcr110.dll
- from %PROGRAM_FILES%\zkPlat\is-HQ12V.tmp to %PROGRAM_FILES%\zkPlat\msvcp110.dll
- from %PROGRAM_FILES%\zkPlat\is-791GU.tmp to %PROGRAM_FILES%\zkPlat\MFC71.dll
- from %PROGRAM_FILES%\zkPlat\is-DC6MI.tmp to %PROGRAM_FILES%\zkPlat\MgRecommend.dll
Network activity:
Connects to:
- 'co##.##ngmangxuan.com':80
- 'cl####.bangmangxuan.com':80
TCP:
HTTP GET requests:
- co##.##ngmangxuan.com/conf/cfg.zip
- cl####.bangmangxuan.com/tongji.html?v=######################################################################################
UDP:
- DNS ASK co##.##ngmangxuan.com
- DNS ASK cl####.bangmangxuan.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
