Technical Information
Malicious functions:
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG' WindowName: ''
Hides the following processes:
- <Full path to virus>
Modifies file system :
Creates the following files:
- <Current directory>ogapjjjk
Deletes the following files:
- <Current directory>ogapjjjk
Network activity:
Connects to:
- 'qn###b.vicp.net':80
TCP:
HTTP POST requests:
- qn###b.vicp.net/gg.asp
UDP:
- DNS ASK qn###b.vicp.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
