Technical Information
Modifies file system
Creates the following files
- %TEMP%\wzgggiuo.js
- %TEMP%\35535.512667882256.exe
Network activity
TCP
HTTP GET requests
- http://fa###xwigs.com/AYLsw1
- http://an#####glutenfree.com/WqoNrY
- http://ta###ciadam.com/NhLUBj
- http://eu###trands.com/EcoSIG
- http://le####rsgalaxy.com/580xkK
- http://de###ome.com/1OStd9
- http://mi###cks.com/byOHev
- http://je##nta.com/dmbj7p
- http://go###ntwigs.com/hM5szn
- http://or####tags.co.uk/BRgn0x
- http://co###nte.com.sg/QAN1G8
UDP
- DNS ASK de#####riaitalia.com
- DNS ASK go###ntwigs.com
- DNS ASK by##t.in
- DNS ASK je##nta.com
- DNS ASK me###ashion.com
- DNS ASK po###chi.com
- DNS ASK mi###cks.com
- DNS ASK de###ome.com
- DNS ASK ne##rre.com
- DNS ASK 1n###print.com
- DNS ASK or####tags.co.uk
- DNS ASK le####rsgalaxy.com
- DNS ASK eu###trands.com
- DNS ASK in####jules.co.uk
- DNS ASK ta###ciadam.com
- DNS ASK 80####opsocal.com
- DNS ASK an#####glutenfree.com
- DNS ASK la##ven.com
- DNS ASK fa###xwigs.com
- DNS ASK ow###aby.com
- DNS ASK bo####lewes.co.uk
- DNS ASK em#.com.sg
- DNS ASK co###nte.com.sg
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wscript.exe' %TEMP%\WZgGGiuo.js
