Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\winlogon.lnk
Modifies file system:
Creates the following files:
- %WINDIR%\Zango\winlogon.exe
- %WINDIR%\Zango\Command.txt
- %WINDIR%\Zango\Zango.dll
Network activity:
Connects to:
- 'za###.usite.pro':80
TCP:
HTTP GET requests:
- http://za###.usite.pro/Area51/zcommand.txt
- http://za###.usite.pro/load/0-0-0-5-20
UDP:
- DNS ASK za###.usite.pro
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '%WINDIR%\Zango\winlogon.exe'
