Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Security Center
- Windows Defender
blocks the following features:
- Windows Action Center
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %LOCALAPPDATA%\ceg.exe
- %LOCALAPPDATA%\4k3f67x81ikjf1treb2h5k3jo20ne7721613pu
- %ALLUSERSPROFILE%\4k3f67x81ikjf1treb2h5k3jo20ne7721613pu
- %TEMP%\4k3f67x81ikjf1treb2h5k3jo20ne7721613pu
- %APPDATA%\microsoft\windows\templates\4k3f67x81ikjf1treb2h5k3jo20ne7721613pu
Deletes itself.
Network activity
UDP
- DNS ASK di###ijavu.com
- DNS ASK qa###oril.com
- DNS ASK fy###egyz.com
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'Media Center Tray Applet' WindowName: ''
- ClassName: '' WindowName: 'View Available Networks'
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: 'BluetoothNotificationAreaIconWindowClass'
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: ''
Creates and executes the following
- '%LOCALAPPDATA%\ceg.exe' -gav <Full path to file>
Executes the following
- '%WINDIR%\explorer.exe'
