Technical Information
Malicious functions:
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
- chrome.exe
- firefox.exe
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = '91.215.159.10:80'
Network activity:
Connects to:
- 'www.pe##iweb.fr':80
TCP:
HTTP GET requests:
- www.pe##iweb.fr/plugins/system/azrul.system/pc_includes/notify.php
UDP:
- DNS ASK www.pe##iweb.fr
