Technical Information
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Modifies file system:
Creates the following files:
- %TEMP%\key.ini
- <Current directory>\winsystem.ini
Network activity:
Connects to:
- 'localhost':1037
- 'zv##.com':80
TCP:
HTTP GET requests:
- http://www.zv##.com/st/key_1.ini via zv##.com
UDP:
- DNS ASK www.zv##.com
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: '___'
