Technical Information
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Modifies file system:
Creates the following files:
- %TEMP%\system.cmd
Network activity:
Connects to:
- 'pa##e.ee':443
- 'f.##wd.se':443
- 'wp#d':80
TCP:
HTTP GET requests:
- http://11#.#11.111.1/wpad.dat via wp#d
UDP:
- DNS ASK pa##e.ee
- DNS ASK f.##wd.se
- DNS ASK wp#d
