Technical Information
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Terminates or attempts to terminate
the following user processes:
- skype.exe
- nod32.exe
Modifies file system :
Creates the following files:
- <Current directory>\bzieeedjmihbsbumfgtnznc.zxg
- %TEMP%\bzieeedjmihbsbumfgtnznc.zxg
- <Current directory>\wc_drop.exe
- %TEMP%\djaemubpa.exe
- %PROGRAM_FILES%\bzieeedjmihbsbumfgtnznc.zxg
- <SYSTEM32>\bzieeedjmihbsbumfgtnznc.zxg
- %WINDIR%\bzieeedjmihbsbumfgtnznc.zxg
- <LS_APPDATA>\bzieeedjmihbsbumfgtnznc.zxg
Network activity:
Connects to:
- 'www.wh###smyip.com':80
- 'www.wh###smyip.ca':80
- 'www.wh###smyip.org':80
- '74.##5.232.51':80
- 'wh#####yipaddress.com':80
- 'wh#####yip.everdot.org':80
TCP:
HTTP GET requests:
- www.wh###smyip.com/
- www.wh###smyip.ca/
- www.wh###smyip.org/
- 74.##5.232.518
- wh#####yipaddress.com/
- wh#####yip.everdot.org/
UDP:
- DNS ASK www.wh###smyip.com
- DNS ASK www.wh###smyip.ca
- DNS ASK www.wh###smyip.org
- DNS ASK www.google.com
- DNS ASK wh#####yipaddress.com
- DNS ASK wh#####yip.everdot.org
