Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\zalo
Modifies file system
Creates the following files
- %HOMEPATH%\desktop\jxmienphi.net.lnk
- <Current directory>\msvcp60d.dll
- <Current directory>\kytrain_pass12345.rar
- <Current directory>\kykeoxe_pass12345.rar
- <Current directory>\kauto.dat
- <Current directory>\interop.autoitx3lib.dll
- <Current directory>\dotnetzip.dll
- <Current directory>\client.dll
- <Current directory>\rainbow.dll
- <Current directory>\cheatverify.dll
- %TEMP%\tmp644e.tmp.bat
- %APPDATA%\zalo.exe
- <Current directory>\autoupdate.rar
- <Current directory>\autoitx3.assembly.dll
- <Current directory>\0tatdefenwin10_xoafile_exe.zip
- <Current directory>\version.xml
- %TEMP%\skype.exe
- nul
- <Current directory>\vlbs_pk_12.rar
Modifies the following files
Network activity
Connects to
- 'jx###nphi.net':80
- 'go#####analytics.com':80
- 'dl.##media.vn':80
- 'st####.adtimaserver.vn':80
- 'dl.##media.vn':443
- 'ad#####static.zascdn.me':443
- 'localhost':7707
- 'localhost':6606
- 'microsoft.com':80
- '61.##.233.88':8808
- 'ze#####.ocsp.sectigo.com':80
TCP
HTTP GET requests
- http://jx###nphi.net/update/
- http://jx###nphi.net/update/tintuc/images/button.jpg
- http://jx###nphi.net/update/tintuc/images/dkn.gif
- http://jx###nphi.net/update/tintuc/js/fadegallery.js
- http://jx###nphi.net/update/tintuc/js/commone942.js?cl############
- http://www.go#####analytics.com/ga.js
- http://www.go#####analytics.com/r/__utm.gif?ut###################################################################################################################################################...
- http://jx###nphi.net/update/capnhat/CheatVerify.dll
- http://dl.##media.vn/master/VLTD-MasterCD.wav?fb##################################################################
- http://jx###nphi.net/update/tintuc/js/mainsite.js
- http://st####.adtimaserver.vn/resource/js/zads-base-mod.js
- http://jx###nphi.net/update/capnhat/DotNetZip.dll
- http://jx###nphi.net/update/capnhat/Interop.AutoItX3Lib.dll
- http://jx###nphi.net/update/capnhat/KAuto.dat
- http://jx###nphi.net/update/capnhat/KYKeoxe_Pass12345.rar
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://jx###nphi.net/update/capnhat/KYTrain_Pass12345.rar
- http://jx###nphi.net/update/capnhat/MSVCP60D.DLL
- http://jx###nphi.net/update/capnhat/Rainbow.dll
- http://jx###nphi.net/update/tintuc/images/bg-wrapper.jpg
- http://jx###nphi.net/update/tintuc/images/line-news.gif
- http://jx###nphi.net/update/tintuc/css/style.css
- http://jx###nphi.net/update/tintuc/css/box-event.css
- http://jx###nphi.net/update/tintuc/css/mainsite.css
- http://jx###nphi.net/skype.exe
- http://jx###nphi.net/update/checkupdate/checkupdate.php
- http://jx###nphi.net/update//version.xml
- http://jx###nphi.net/update/tintuc/index.html?re##########################################
- http://jx###nphi.net/update/tintuc/slide/index.html?re##########################################
- http://jx###nphi.net/update/capnhat/0tatdefenwin10_xoafile_exe.zip
- http://jx###nphi.net/update/tintuc/slide/hjs/jquery-1.9.1.min.js
- http://jx###nphi.net/update/tintuc/slide/js/jssor.js
- http://jx###nphi.net/update/capnhat/VLBS_PK_12.rar
- http://jx###nphi.net/update/capnhat/Client.dll
- http://jx###nphi.net/update/tintuc/slide/js/jssor.slider.js
- http://jx###nphi.net/update/tintuc/slide/images/1.jpg
- http://jx###nphi.net/update/tintuc/slide/images/2.jpg
- http://jx###nphi.net/update/tintuc/slide/images/3.jpg
- http://jx###nphi.net/update/capnhat/AutoItX3.Assembly.dll
- http://jx###nphi.net/update/tintuc/slide/images/4.jpg
- http://jx###nphi.net/update/capnhat/Autoupdate.rar
- http://jx###nphi.net/update/tintuc/img/loading.gif
- http://jx###nphi.net/update/tintuc/img/a17.png
- http://jx###nphi.net/AutoPk.php
- http://jx###nphi.net/update/tintuc/slide/images/bg7.jpg
- http://ze#####.ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQILj%2F5BYz%2BinwYvRPv3x0WYHB6awQUyNl4aKLZGWjVPXLeXwo%2B3LWGhqYCEQC8RijnEKbpDhRg%2BNsIBmnu
Other
- 'dl.##media.vn':443
- 'ad#####static.zascdn.me':443
- '61.##.233.88':8808
UDP
- DNS ASK jx###nphi.net
- DNS ASK go#####analytics.com
- DNS ASK dl.##media.vn
- DNS ASK st####.adtimaserver.vn
- DNS ASK ad#####static.zascdn.me
- DNS ASK microsoft.com
- DNS ASK ze#####.ocsp.sectigo.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\skype.exe'
- '%APPDATA%\zalo.exe'
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "zalo" /tr '"%APPDATA%\zalo.exe"' & exit' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "zalo" /tr '"%APPDATA%\zalo.exe"' & exit
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\tmp644E.tmp.bat""
- '%WINDIR%\syswow64\schtasks.exe' /create /f /sc onlogon /rl highest /tn "zalo" /tr '"%APPDATA%\zalo.exe"'
- '%WINDIR%\syswow64\timeout.exe' 3
