Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\2019ZipService] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\2019ZipService] 'ImagePath' = '%LOCALAPPDATA%\2019Zip\2019ZipService.exe'
Modifies file system
Creates the following files
- %TEMP%\nsucfdb.tmp
- %PROGRAMDATA%\microsoft\windows\start menu\programs\6789ñ¹ëõ\ð¶ôø 6789ñ¹ëõ.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\6789ñ¹ëõ\ 6789ñ¹ëõ.lnk
- %LOCALAPPDATA%\2019zip\lang\zh-cn.txt
- %LOCALAPPDATA%\2019zip\lang\en.ttt
- %LOCALAPPDATA%\2019zip\zip.sfx
- %LOCALAPPDATA%\2019zip\uninst.exe
- %LOCALAPPDATA%\2019zip\duilib.dll
- %LOCALAPPDATA%\2019zip\2019zipupdate.exe
- %LOCALAPPDATA%\2019zip\2019ziptray.exe
- %LOCALAPPDATA%\2019zip\2019zipsvchost.exe
- %LOCALAPPDATA%\2019zip\2019zipsvchost.dll
- C:\users\public\desktop\6789ñ¹ëõ.lnk
- %LOCALAPPDATA%\2019zip\2019zipshell64.dll
- %LOCALAPPDATA%\2019zip\2019zipservice.exe
- %LOCALAPPDATA%\2019zip\2019ziprmextern64.dll
- %LOCALAPPDATA%\2019zip\2019ziprmextern.dll
- %LOCALAPPDATA%\2019zip\2019zipminipageplugin.dll
- %LOCALAPPDATA%\2019zip\2019zipminipage.exe
- %LOCALAPPDATA%\2019zip\2019zipgui.exe
- %LOCALAPPDATA%\2019zip\2019zipcore.dll
- %LOCALAPPDATA%\2019zip\2019zip.exe
- %TEMP%\nsjcfeb.tmp\system.dll
- %TEMP%\nsjcfeb.tmp\duilib.dll
- %TEMP%\nsjcfeb.tmp\insthlp.dll
- %LOCALAPPDATA%\2019zip\2019zipshell.dll
- %APPDATA%\2019zip\cfg\upcfg
Deletes the following files
- %TEMP%\nsjcfeb.tmp\duilib.dll
- %TEMP%\nsjcfeb.tmp\insthlp.dll
- %TEMP%\nsjcfeb.tmp\system.dll
Network activity
TCP
- 'so##.6789.net':443
- 'do##.#oft.6789.net':443
UDP
- DNS ASK so##.6789.net
- DNS ASK re##.#oft.6789.net
- DNS ASK do##.#oft.6789.net
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\2019zip\2019zipupdate.exe' -inst_fix -startby=8
- '%LOCALAPPDATA%\2019zip\2019zipservice.exe'
- '%LOCALAPPDATA%\2019zip\2019zipupdate.exe' -auto -startby=5
- '%LOCALAPPDATA%\2019zip\2019zipupdate.exe' -task -startby=2
- '%LOCALAPPDATA%\2019zip\2019zipupdate.exe' -update_silence -startby=2
- '%LOCALAPPDATA%\2019zip\2019zipupdate.exe' -tid=1 -startby=2
- '%WINDIR%\syswow64\regsvr32.exe' /s /u "%LOCALAPPDATA%\2019Zip\2019ZipShell64.dll"' (with hidden window)
- '%WINDIR%\syswow64\regsvr32.exe' /s "%LOCALAPPDATA%\2019Zip\2019ZipShell64.dll"' (with hidden window)
- '%LOCALAPPDATA%\2019zip\2019zipupdate.exe' -task -startby=2' (with hidden window)
- '%LOCALAPPDATA%\2019zip\2019zipupdate.exe' -update_silence -startby=2' (with hidden window)
- '%LOCALAPPDATA%\2019zip\2019zipupdate.exe' -tid=1 -startby=2' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe' /s /u "%LOCALAPPDATA%\2019Zip\2019ZipShell64.dll"
- '<SYSTEM32>\regsvr32.exe' /s /u "%LOCALAPPDATA%\2019Zip\2019ZipShell64.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%LOCALAPPDATA%\2019Zip\2019ZipShell64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%LOCALAPPDATA%\2019Zip\2019ZipShell64.dll"
