Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\ZuldiWatchDog] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ZuldiWatchDog] 'ImagePath' = '"c:\zuldi\ZuldiWatchDog.exe"'
Modifies file system
Creates the following files
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- C:\zuldi\plugin_current\posplugin.rsa.clj.dll
- C:\zuldi\plugin_current\posplugin.sql.clj.dll
- C:\zuldi\plugin_current\posplugin.transaction.clj.dll
- C:\zuldi\plugin_current\printingplugin.dll
- C:\zuldi\plugin_current\quartz.dll
- C:\zuldi\plugin_current\shockwaveflashobjects.dll
- C:\zuldi\plugin_current\stdole.dll
- C:\zuldi\plugin_current\version
- C:\zuldi\plugin_current\zuldiwatchdog.exe
- C:\zuldi\plugin_current\zuldiwatchdog.exe.config
- C:\zuldi\plugin_current\zuldiwatchdog.vshost.exe
- C:\zuldi\plugin_current\zuldiwatchdog.vshost.exe.config
- C:\zuldi\plugin_current\zuldiwatchdog.vshost.exe.manifest
- C:\zuldi\plugin_current\posplugin.display_parser.clj.dll
- C:\zuldi\plugin_current\posplugin.decrypt.clj.dll
- C:\zuldi\plugin_current\resposapi.interop.dll
- C:\zuldi\plugin_current\resprintapi.interop.dll
- C:\zuldi\plugin_current\pms1302.isl
- C:\zuldi\plugin_current\posplugin.sim.clj.dll
- C:\zuldi\plugin_current\posplugin.dbs.clj.dll
- C:\zuldi\s.z
- C:\zuldi\zuldiwatchdog.exe
- C:\zuldi\clojure.dll
- C:\zuldi\microsoft.dynamic.dll
- C:\zuldi\microsoft.scripting.dll
- C:\zuldi\icsharpcode.sharpziplib.dll
- <Current directory>\installutil.installlog
- C:\zuldi\plugin_current\posplugin.repl.clj.dll
- C:\zuldi\zuldiwatchdog.installlog
- C:\zuldi\plugin_current\posplugin.registry.clj.dll
- C:\zuldi\plugin_current\posplugin.printer.clj.dll
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- C:\zuldi\v.zip
- C:\zuldi\plugin_current\bouncycastle.crypto.dll
- C:\zuldi\plugin_current\clojure.dll
- C:\zuldi\plugin_current\common.logging.core.dll
- C:\zuldi\plugin_current\common.logging.dll
- C:\zuldi\plugin_current\commonutils.dll
- C:\zuldi\plugin_current\dblgen16.dll
- C:\zuldi\plugin_current\flashcontrolv71.dll
- C:\zuldi\plugin_current\ianywhere.data.sqlanywhere.v4.5.dll
- C:\zuldi\plugin_current\icsharpcode.sharpziplib.dll
- C:\zuldi\plugin_current\interop.microssecuritylog.dll
- C:\zuldi\plugin_current\interop.resposapi.dll
- C:\zuldi\plugin_current\micros.reportviewer.controls.dll
- C:\zuldi\plugin_current\micros.reportviewer.data.dll
- C:\zuldi\plugin_current\micros.reportviewer.engine.dll
- C:\zuldi\plugin_current\micros3700plugin.exe
- C:\zuldi\plugin_current\micros3700plugin.exe.config
- C:\zuldi\plugin_current\micros3700plugin.vshost.exe
- C:\zuldi\plugin_current\micros3700plugin.vshost.exe.config
- C:\zuldi\plugin_current\micros3700plugin.vshost.exe.manifest
- C:\zuldi\plugin_current\microsoft.dynamic.dll
- C:\zuldi\plugin_current\microsoft.scripting.dll
- C:\zuldi\plugin_current\posplugin.api.clj.dll
- C:\zuldi\plugin_current\posplugin.export.clj.dll
- C:\zuldi\plugin_current\posplugin.integrity.clj.dll
- C:\zuldi\plugin_current\posplugin.menu.clj.dll
- C:\zuldi\plugin_current\posplugin.realtime.clj.dll
- C:\zuldi\zuldiwatchdog.installstate
Network activity
TCP
HTTP GET requests
- http://x.##2.us/x.cer
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK ad###.zuldi.co
- DNS ASK x.##2.us
- DNS ASK dy####c.zuldi.co
Miscellaneous
Searches for the following windows
- ClassName: 'TrayNotifyWnd' WindowName: ''
- ClassName: 'SysPager' WindowName: ''
- ClassName: 'ToolbarWindow32' WindowName: 'Notification Area'
- ClassName: 'ToolbarWindow32' WindowName: 'User Promoted Notification Area'
- ClassName: 'NotifyIconOverflowWindow' WindowName: ''
- ClassName: 'ToolbarWindow32' WindowName: 'Overflow Notification Area'
Creates and executes the following
- 'C:\zuldi\zuldiwatchdog.exe'
- 'C:\zuldi\plugin_current\micros3700plugin.exe'
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\installutil.exe' c:\zuldi\ZuldiWatchDog.exe
- '%WINDIR%\syswow64\sc.exe' config "ZuldiWatchDog" start= delayed-auto
- '%WINDIR%\syswow64\sc.exe' failure "ZuldiWatchDog" reset= 0 actions= restart/60000
- '%WINDIR%\syswow64\sc.exe' start "ZuldiWatchDog"
