Technical Information
Malicious functions:
Terminates or attempts to terminate
the following user processes:
- AVP.EXE
- bdagent.exe
Network activity:
Connects to:
- 'wt###ck.esy.es':80
- 'wp#d':80
TCP:
HTTP GET requests:
- http://wt###ck.esy.es/control/Vip.php
- http://wt###ck.esy.es/control/Fecha.php
- http://11#.#11.111.1/wpad.dat via wp#d
- http://wt###ck.esy.es/control/Version.html
UDP:
- DNS ASK wt###ck.esy.es
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
