Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im <File name>.exe
Modifies file system
Creates the following files
- <Current directory>\log.txt
- %TEMP%\sxzs_update.tmp
- %TEMP%\sxzs_update.exe
- %TEMP%\2025110498100535.zip
- <Current directory>\sxzs_hy2025_v25.11.04.exe
- %TEMP%\xcgui.dll
Network activity
Connects to
- 'yz.##asd.vip':999
TCP
HTTP GET requests
- http://yz.###sd.vip:999/upload/zip/2025110498100535.zip via yz.##asd.vip
HTTP POST requests
- http://yz.###sd.vip:999/ac.php?s=################################ via yz.##asd.vip
UDP
- DNS ASK yz.##asd.vip
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\sxzs_update.exe' update
- '<Current directory>\sxzs_hy2025_v25.11.04.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c start %TEMP%\sxzs_update.exe update
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im <File name>.exe
- '<SYSTEM32>\cmd.exe' /c del <Full path to file>
- '<SYSTEM32>\cmd.exe' /c start <Current directory>\sxzs_hy2025_v25.11.04.exe
