Technical Information
Modifies file system
Creates the following files
- %APPDATA%\lszip\ls01_gwall\lshenzip.exe
- %APPDATA%\lszip\ys4_gwall\lshighzip.exe
- %TEMP%\mn938c.tmp.tlb
Network activity
Connects to
- 'gw.##icdn.com':443
TCP
HTTP GET requests
- http://do###.#horzip.muxin.fun/logo/v1.0.0.2/super.gif.MD5
- http://07#####ni.eastday.com/mobile/20200430/20200430110938_c8821633307b36c3eb2d0606c7f34756_9_mwpm_03200403.jpg
- http://ne##.7654.com/tipsdsp/libs/script/zhike.js?v=######
- http://01#####ni.eastday.com/mobile/20200430/20200430111004_a5f75fb27f7f0ef5e6eb1df169775b71_18_mwpm_03200403.jpg
- http://01#####ni.eastday.com/mobile/20200430/20200430111004_a5f75fb27f7f0ef5e6eb1df169775b71_15_mwpm_03200403.jpg
- http://00#####ni.eastday.com/mobile/20200430/20200430110934_013e03197a418a5ca5c91b3754bca50e_3_mwpm_03200403.jpg
- http://00#####ni.eastday.com/mobile/20200430/20200430110934_013e03197a418a5ca5c91b3754bca50e_1_mwpm_03200403.jpg
- http://ne##.7654.com/tipsdsp/libs/script/kgdsp.js?v=#####
- http://mi####i.7654.com/mini/news/page_type/pn/abckantu/type/qiche/page/1
- http://07#####ni.eastday.com/mobile/20190328/20190328170438_424f75a04e09ef9734148c3b41e2a916_3_mwpm_03200403.jpg
- http://07#####ni.eastday.com/mobile/20190328/20190328170438_424f75a04e09ef9734148c3b41e2a916_1_mwpm_03200403.jpg
- http://ne##.7654.com/tipsdsp/libs/script/shdsp2.js?v=#####
- http://06#####ni.eastday.com/mobile/20190327/2019032711_b81b0d94483b4c8ab2a30275fcd0317e_1634_mwpm_03200403.jpg
- http://07#####ni.eastday.com/mobile/20190328/20190328170438_424f75a04e09ef9734148c3b41e2a916_2_mwpm_03200403.jpg
- http://ne##.7654.com/tipsdsp/libs/sh_config.js?v=#####
- http://ma###.mediav.com/rtb?ty###################################################################################################################################################################...
- http://ne##.7654.com/tipsdsp/libs/script/zmdsp_new.js?v=#####
- http://mi####i.7654.com/mini/news/page_type/pn/abckantu/type/tiyu/page/1
- http://ne##.7654.com/tipsdsp/libs/script/shdsp_new.js?v=######
- http://s3#.#zwgs.com/galileo/9dd5678f3c97fcdffead244b4a55db85.jpg
- http://s3##.nzwgs.com/galileo/2b10f6d21a3fa60f44a34ce4004e416a.gif
- http://ne##.7654.com/tipsdsp/libs/config.js?v=###
- http://s3#.#zwgs.com/galileo/296f2ff3a208b3be88caff43a4488de1.jpg
- http://s3#.#zwgs.com/galileo/3f87bfc6d151770408d26e8c5b1cbef4.jpg
- http://ne##.7654.com/tipsdsp/libs/script/common.js
- http://s3##.nzwgs.com/galileo/52b958d183cc940e9962e0395c9d328f.gif
- http://ne##.7654.com/tipsdsp/libs/script/json2.js
- http://04#####ni.eastday.com/mobile/20200615/20200615063923_8af76d56a345268d3a4cbd34b557504b_10_mwpm_03201609.jpg
- http://07#####ni.eastday.com/mobile/20200430/20200430110938_c8821633307b36c3eb2d0606c7f34756_2_mwpm_03200403.jpg
- http://08#####ni.eastday.com/mobile/20200430/20200430111035_045187f48d510b8addd21abaea79b85c_1_mwpm_03200403.jpg
- http://08#####ni.eastday.com/mobile/20200430/20200430111035_045187f48d510b8addd21abaea79b85c_6_mwpm_03200403.jpg
- http://09#####ni.eastday.com/mobile/20200430/20200430111120_b0cea39523ecb3ecefb0459b8e83036d_6_mwpm_03200403.jpg
- http://03#####ni.eastday.com/mobile/20200430/20200430111055_328d6765df9b9e17fa814c97d2f3b7e5_7_mwpm_03200403.jpg
- http://s3#.#zwgs.com/galileo/62641878834515c44fa4622a74679542.jpg
- http://03#####ni.eastday.com/mobile/20200430/20200430111055_328d6765df9b9e17fa814c97d2f3b7e5_6_mwpm_03200403.jpg
- http://07#####ni.eastday.com/mobile/20200430/20200430111043_1fb78358146f42bac041011c2f174386_3_mwpm_03200403.jpg
- http://00#####ni.eastday.com/mobile/20200430/20200430111009_09db6cd975438ef2354a4e67b2b24993_2_mwpm_03200403.jpg
- http://s3##.nzwgs.com/galileo/abf6ee2eccebb9e51536e7ebda105560.gif
- http://s3##.nzwgs.com/galileo/67d9abeb3143abb663fa622b35156e94.gif
- http://s3#.#zwgs.com/galileo/876959-64d5328a95bb08ac2dd99a8c356c6dcd.jpg
- http://s3#.#zwgs.com/galileo/890274-95e40a7dfc49630a943d7e4361015248.jpg
- http://07#####ni.eastday.com/mobile/20200430/20200430111043_1fb78358146f42bac041011c2f174386_6_mwpm_03200403.jpg
- http://03#####ni.eastday.com/mobile/20200430/20200430111055_328d6765df9b9e17fa814c97d2f3b7e5_4_mwpm_03200403.jpg
- http://00#####ni.eastday.com/mobile/20200430/20200430111007_0a11fd918c540071a10214ed66419854_5_mwpm_03200403.jpg
- http://00#####ni.eastday.com/mobile/20200430/20200430111009_09db6cd975438ef2354a4e67b2b24993_3_mwpm_03200403.jpg
- http://07#####ni.eastday.com/mobile/20200430/20200430111043_1fb78358146f42bac041011c2f174386_5_mwpm_03200403.jpg
- http://03#####ni.eastday.com/mobile/20200430/20200430111008_f0e0828cc945103dde33d9ffea33db3c_4_mwpm_03200403.jpg
- http://ne##.7654.com/tipsdsp/20/assets/s11.js?v=######
- http://09#####ni.eastday.com/mobile/20200430/20200430111120_b0cea39523ecb3ecefb0459b8e83036d_3_mwpm_03200403.jpg
- http://00#####ni.eastday.com/mobile/20200430/20200430111009_09db6cd975438ef2354a4e67b2b24993_1_mwpm_03200403.jpg
- http://00#####ni.eastday.com/mobile/20200430/20200430111007_0a11fd918c540071a10214ed66419854_6_mwpm_03200403.jpg
- http://03#####ni.eastday.com/mobile/20200430/20200430111008_f0e0828cc945103dde33d9ffea33db3c_2_mwpm_03200403.jpg
- http://03#####ni.eastday.com/mobile/20200430/20200430111008_f0e0828cc945103dde33d9ffea33db3c_6_mwpm_03200403.jpg
- http://07#####ni.eastday.com/mobile/20200430/20200430110938_c8821633307b36c3eb2d0606c7f34756_3_mwpm_03200403.jpg
- http://08#####ni.eastday.com/mobile/20200430/20200430111035_045187f48d510b8addd21abaea79b85c_2_mwpm_03200403.jpg
- http://ne##.7654.com/tipsdsp/libs/script/zmdsp_t.js?v=#####
- http://01#####ni.eastday.com/mobile/20200430/20200430111004_a5f75fb27f7f0ef5e6eb1df169775b71_2_mwpm_03200403.jpg
- http://00#####ni.eastday.com/mobile/20200430/20200430111007_0a11fd918c540071a10214ed66419854_2_mwpm_03200403.jpg
- http://00#####ni.eastday.com/mobile/20200430/20200430110934_013e03197a418a5ca5c91b3754bca50e_4_mwpm_03200403.jpg
- http://09#####ni.eastday.com/mobile/20200430/20200430111120_b0cea39523ecb3ecefb0459b8e83036d_4_mwpm_03200403.jpg
- http://s3##.nzwgs.com/galileo/617046e07c2199e0951bdb0bdc362118.gif
- http://04#####ni.eastday.com/mobile/20200615/20200615063923_8af76d56a345268d3a4cbd34b557504b_16_mwpm_03201609.jpg
- http://ne##.7654.com/tipsdsp/libs/swiper/idangerous.swiper.min.js
- http://04#####ni.eastday.com/mobile/20200615/20200615063923_8af76d56a345268d3a4cbd34b557504b_7_mwpm_03201609.jpg
- http://ne##.7654.com/tpop4/miniapi/recommend.json
- http://ad#.#654.com/prod/news.7654.com.mini_new4.0512.json?t=#############
- http://ss#.#654.com/ct/m?mi######################################################################################################################################################################...
- http://do###.#horzip.muxin.fun/tui/tips/2/tips2.zip.MD5
- http://ip####tion.7654.com/v1
- http://ne##.7654.com/mini_new4/0512/statics/assets/images/right.png
- http://ne##.7654.com/mini_new4/0512/statics/assets/images/left.png
- http://ne##.7654.com/mini_new4/0512/statics/assets/js/index.js?v=####
- http://ne##.7654.com/mini_new4/0512/statics/common/js/idangerous.swiper.min.js
- http://ne##.7654.com/mini_new4/0512/statics/common/js/jquery.xDomain.js
- http://ne##.7654.com/mini_new4/0512/statics/common/js/jquery.base64.js
- http://ne##.7654.com/mini_new4/0512/statics/common/js/jquery.cookie.js
- http://ne##.7654.com/mini_new4/0512/statics/common/js/jquery.min.js
- http://ne##.7654.com/mini_new4/0512/statics/assets/images/toggle_nav.png
- http://ne##.7654.com/mini_new4/0512/statics/assets/css/index.css?v=####
- http://ne##.7654.com/mini_new4/0512/statics/common/css/idangerous.swiper.css
- http://do###.#horzip.muxin.fun/tui/package/tipsplus2/v1.0.5.8/tipsplus2.gif
- http://ne##.7654.com/mini_new4/0512/?qi##########################################################################################################################################################...
- http://re####.#horzip.muxin.fun/lszip/bubble_info?co#############################################################################################################################################...
- http://ss#.#654.com/ct?mi########################################################################################################################################################################...
- http://do###.#horzip.muxin.fun/tui/package/tipsplus2/v1.0.2.3/tipsplus2-3.exe
- http://do###.#horzip.muxin.fun/tui/package/mininewsplus/v5.0.293.17/mininewsplus.gif
- http://do###.#horzip.muxin.fun/tui/package/mininewsplus/v5.0.271.93/mininews-2.exe
- http://do####.#horzip.muxin.fun/thorzippath
- http://do###.#horzip.muxin.fun/logo/v1.0.0.2/uc.gif
- http://do###.#horzip.muxin.fun/logo/v1.0.0.2/uc.gif.MD5
- http://do###.#horzip.muxin.fun/logo/v1.0.0.2/super.gif
- http://sh##.#.mediav.com/s?ty####################################################################################################################################################################...
- http://do###.#horzip.muxin.fun/tui/tipsplus2/tipsplus2.json
- http://ne##.7654.com/mini_new4/0512/statics/assets/images/adtxt.png
- http://06#####ni.eastday.com/mobile/20200614/20200614223543_9da07ed700077d8858e345522d5d7ac6_1_mwpm_03201609.jpg
- http://s3#.#zwgs.com/galileo/896640-bb0fd03d76c991dc178488dd4ee2c69a.jpg
- http://00#####ni.eastday.com/mobile/20200615/20200615064154_c24bcc128e7e214b4256962bfb2f8825_8_mwpm_03201609.jpg
- http://00#####ni.eastday.com/mobile/20200615/20200615064154_c24bcc128e7e214b4256962bfb2f8825_9_mwpm_03201609.jpg
- http://ne##.7654.com/tipsdsp/libs/script/jquery.base64.js
- http://04#####ni.eastday.com/mobile/20200615/20200615063425_1c80085f514327cab3721c0832efc1a4_1_mwpm_03201609.jpg
- http://04#####ni.eastday.com/mobile/20200615/20200615063039_602b6c9ef7bae723904b6dedcb00ec14_3_mwpm_03201609.jpg
- http://s3#.#zwgs.com/galileo/39f72d4bbc30c97cc593dcf575668cca.jpg
- http://04#####ni.eastday.com/mobile/20200615/20200615063039_602b6c9ef7bae723904b6dedcb00ec14_5_mwpm_03201609.jpg
- http://01#####ni.eastday.com/mobile/20200615/20200615062319_6130c4ef5aa28c47d6bae5b48294dea0_11_mwpm_03201609.jpg
- http://00#####ni.eastday.com/mobile/20200615/20200615064154_c24bcc128e7e214b4256962bfb2f8825_1_mwpm_03201609.jpg
- http://00#####ni.eastday.com/mobile/20200615/20200615064154_c24bcc128e7e214b4256962bfb2f8825_2_mwpm_03201609.jpg
- http://s3##.nzwgs.com/galileo/787732e9eebfb20807d317fac9c3116b-rs_middle.gif
- http://01#####ni.eastday.com/mobile/20200615/20200615062319_6130c4ef5aa28c47d6bae5b48294dea0_7_mwpm_03201609.jpg
- http://ma###.p4p.1688.com/maxmap?ve#########################################
- http://ne##.7654.com/tipsdsp/libs/script/jquery.cookie.domain.js
- http://04#####ni.eastday.com/mobile/20200615/20200615063039_602b6c9ef7bae723904b6dedcb00ec14_1_mwpm_03201609.jpg
- http://04#####ni.eastday.com/mobile/20200615/20200615063039_602b6c9ef7bae723904b6dedcb00ec14_6_mwpm_03201609.jpg
- http://05#####ni.eastday.com/mobile/20200615/20200615063557_5cd2b199e73bd760621da29def55903c_1_mwpm_03201609.jpg
- http://01#####ni.eastday.com/mobile/20200615/20200615062319_6130c4ef5aa28c47d6bae5b48294dea0_2_mwpm_03201609.jpg
- http://01#####ni.eastday.com/mobile/20200615/20200615062319_6130c4ef5aa28c47d6bae5b48294dea0_25_mwpm_03201609.jpg
- http://ne##.7654.com/tipsdsp/libs/script/jquery.min.js
- http://ne##.7654.com/tipsdsp/libs/css/zhike.css?v=#####
- http://ne##.7654.com/tipsdsp/libs/swiper/idangerous.swiper.css
- http://s3.##bdw.com/s?ty#########################################################################################################################################################################...
- http://07#####ni.eastday.com/mobile/20200614/20200614223611_2c4b9343c98cefe6c66fe18ab176e97b_1_mwpm_03201609.jpg
- http://ad.##aizip.com/advertise/userclick?ti#####################################################################################################################################################...
- http://ne##.7654.com/tipsdsp/20/s11/?pr##########################################################################################################################################################...
- http://mi####i.7654.com/mini/news/recommend
- http://04#####ni.eastday.com/mobile/20200615/20200615063923_8af76d56a345268d3a4cbd34b557504b_1_mwpm_03201609.jpg
- http://ss#.#654.com/ssp/v2/ads?qi################################################################################################################################################################...
HTTP POST requests
- http://kl.##ayg.com/zkactive/ctl/w/qinfo.html
UDP
- DNS ASK do###.#horzip.muxin.fun
- DNS ASK 02#####ni.eastday.com
- DNS ASK 09#####ni.eastday.com
- DNS ASK 03#####ni.eastday.com
- DNS ASK at.##icdn.com
- DNS ASK h5###.m.tmall.com
- DNS ASK lo#.#mstat.com
- DNS ASK to####m.taobao.com
- DNS ASK ws.##stat.com
- DNS ASK lo###.taobao.com
- DNS ASK s.####k.taobao.com
- DNS ASK gm.##stat.com
- DNS ASK fo####r.taobao.com
- DNS ASK oc#####ce.taobao.com
- DNS ASK ka####oo.alicdn.com
- DNS ASK pa##.tmall.com
- DNS ASK kl.##ayg.com
- DNS ASK gw.##icdn.com
- DNS ASK tm##l.com
- DNS ASK mo#.#.taobao.com
- DNS ASK ad##.kpzip.com
- DNS ASK g.###cdn.com
- DNS ASK 08#####ni.eastday.com
- DNS ASK im#.#licdn.com
- DNS ASK 61#.#mall.com
- DNS ASK s.####k.tmall.com
- DNS ASK ss#.#654.com
- DNS ASK re####.#horzip.muxin.fun
- DNS ASK ne##.7654.com
- DNS ASK ad#.#654.com
- DNS ASK ip####tion.7654.com
- DNS ASK hm.##idu.com
- DNS ASK mi####i.7654.com
- DNS ASK sh##.#.mediav.com
- DNS ASK 06#####ni.eastday.com
- DNS ASK ad###.kpzip.com
- DNS ASK tb##.alicdn.com
- DNS ASK 07#####ni.eastday.com
- DNS ASK ma###.mediav.com
- DNS ASK s3.##bdw.com
- DNS ASK ad.##aizip.com
- DNS ASK 01#####ni.eastday.com
- DNS ASK 04#####ni.eastday.com
- DNS ASK 05#####ni.eastday.com
- DNS ASK 00#####ni.eastday.com
- DNS ASK s3#.#zwgs.com
- DNS ASK ma###.p4p.1688.com
- DNS ASK do####.#horzip.muxin.fun
- DNS ASK s3##.nzwgs.com
- DNS ASK pc####e.tmall.com
Miscellaneous
Searches for the following windows
- ClassName: 'E969AAD1-ACD6-462C-8BD2-E7B60CFD9C31' WindowName: 'E969AAD1-ACD6-462C-8BD2-E7B60CFD9C31'
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%APPDATA%\lszip\ls01_gwall\lshenzip.exe' LVBST0pFQ1Q9bHN5cyAtU3VwcG9ydE11bHRpRXhlPXRydWUgLXdyaXRldGNrPUxpdmVVcGRhdGUzNjAsNjMyIC11c2Vzc3Btb2RlPXRydWUgLXRpdGxlPUxzX21pbml6aXAgLWNsYXNzbmFtZT1Mc19taW5pemlwIC1vcHRpbWl6ZT01MCAtTXV0ZXhOYW1lP...
- '%APPDATA%\lszip\ys4_gwall\lshighzip.exe' z/2z3k8ESYtL6n/+Ki5m4srSvUL8QdNeltKp9AhOKAINWLlJcrGTxj9WmccPAH6d0Z6zGntm5G/ZMm9NyKLilYx5Fl774mKZhtWiNodw39PAFDRyfyOwhRlCXEiOO63c/uSXF/lcIjQWZ1ez2DANeZPE9bqhdJgUuFBrhXJ7eTatHTqQ0k5TQ9oLbq/Lwh7Wp...
Executes the following
- '%ProgramFiles(x86)%\mozilla firefox\firefox.exe' https://s.click.taobao.com/RwUuxzu
