Technical Information
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Terminates or attempts to terminate
the following user processes:
- nod32.exe
Modifies file system :
Creates the following files:
- <Current directory>\bzieeedjmihbsbumfgtnznc.zxg
- %TEMP%\bzieeedjmihbsbumfgtnznc.zxg
- <Current directory>\wc_drop.exe
- %TEMP%\djaemubpa.exe
- %PROGRAM_FILES%\bzieeedjmihbsbumfgtnznc.zxg
- <SYSTEM32>\bzieeedjmihbsbumfgtnznc.zxg
- %WINDIR%\bzieeedjmihbsbumfgtnznc.zxg
- <LS_APPDATA>\bzieeedjmihbsbumfgtnznc.zxg
Network activity:
Connects to:
- 'wh#####yip.everdot.org':80
- 'www.wh###smyip.org':80
- 'www.wh###smyip.com':80
- 'we#####rcrm.localdomain':80
- 'www.wh###smyip.ca':80
- 'wh#####yipaddress.com':80
TCP:
HTTP GET requests:
- wh#####yip.everdot.org/
- www.wh###smyip.org/
- www.wh###smyip.com/
- we#####rcrm.localdomain???#
- www.wh###smyip.ca/
- wh#####yipaddress.com/
UDP:
- DNS ASK wh#####yip.everdot.org
- DNS ASK www.wh###smyip.org
- DNS ASK www.wh###smyip.com
- DNS ASK we#####rcrm.localdomain
- DNS ASK www.wh###smyip.ca
- DNS ASK wh#####yipaddress.com
