Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Christ' = '%HOMEPATH%\sxpzhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Christ' = '<Full path to virus>'
Malicious functions:
Creates and executes the following:
- %HOMEPATH%\sxpzhost.exe
Executes the following:
- %WINDIR%\explorer.exe
Modifies file system :
Creates the following files:
- %HOMEPATH%\sxpzhost.exe
Miscellaneous:
Searches for the following windows:
- ClassName: 'MozillaUIWindowClass' WindowName: 'Halifax UK | Bank Accounts, Savings, Loans & Mortgages - Mozilla Firefox'
- ClassName: '{1C03B488-D53B-4a81-97F8-754559640193}' WindowName: 'Lloyds TSB - Current Bank Accounts, Personal Banking, Financial Services'
- ClassName: 'Chrome_WidgetWin_0' WindowName: 'Lloyds TSB - Current Bank Accounts, Personal Banking, Financial Services - Google Chrome'
- ClassName: 'IEFrame' WindowName: 'Halifax UK | Bank Accounts, Savings, Loans & Mortgages - Windows Internet Explorer'
- ClassName: 'IEFrame' WindowName: 'Halifax UK | Bank Accounts, Savings, Loans & Mortgages - Microsoft Internet Explorer'
- ClassName: 'MozillaWindowClass' WindowName: 'Halifax UK | Bank Accounts, Savings, Loans & Mortgages - Mozilla Firefox'
- ClassName: 'MozillaWindowClass' WindowName: 'Lloyds TSB - Current Bank Accounts, Personal Banking, Financial Services - Mozilla Firefox'
- ClassName: 'MozillaUIWindowClass' WindowName: 'Lloyds TSB - Current Bank Accounts, Personal Banking, Financial Services - Mozilla Firefox'
- ClassName: '{1C03B488-D53B-4a81-97F8-754559640193}' WindowName: 'Log in to online banking - Google Chrome'
- ClassName: 'IEFrame' WindowName: 'https://online.lloydstsb.co.uk/personal/logon/login.jsp?WT.ac=hpIBlogon - Windows Internet Explorer'
- ClassName: 'IEFrame' WindowName: 'Lloyds TSB - Current Bank Accounts, Personal Banking, Financial Services - Windows Internet Explorer'
- ClassName: 'IEFrame' WindowName: 'Lloyds TSB - Current Bank Accounts, Personal Banking, Financial Services - Microsoft Internet Explorer'
- ClassName: 'IEFrame' WindowName: 'Nationwide Building Society - Internet Banking - Microsoft Internet Explorer'
- ClassName: 'IEFrame' WindowName: 'Log in - Nationwide Internet Bank - Microsoft Internet Explorer'
- ClassName: 'MozillaWindowClass' WindowName: 'Log in - Nationwide Internet Bank - Mozilla Firefox'
- ClassName: '{1C03B488-D53B-4a81-97F8-754559640193}' WindowName: 'Log in - Nationwide Internet Bank'
- ClassName: 'Chrome_WidgetWin_0' WindowName: 'Log in - Nationwide Internet Bank - Google Chrome'
- ClassName: 'IEFrame' WindowName: 'Log in - Nationwide Internet Bank - Windows Internet Explorer'
- ClassName: 'Chrome_WidgetWin_0' WindowName: 'Halifax | Mortgages, Bank Accounts, Savings, Credit Cards, Loans, ISAs - Google Chrome'
- ClassName: 'Chrome_WidgetWin_0' WindowName: 'Halifax UK | Bank Accounts, Savings, Loans & Mortgages - Google Chrome'
- ClassName: 'IEFrame' WindowName: 'https://www.halifax-online.co.uk/personal/logon/login.jsp - Windows Internet Explorer'
- ClassName: 'MozillaWindowClass' WindowName: 'Nationwide Building Society - Internet Banking - Mozilla Firefox'
- ClassName: 'MozillaUIWindowClass' WindowName: 'Log in - Nationwide Internet Bank - Mozilla Firefox'
- ClassName: '{1C03B488-D53B-4a81-97F8-754559640193}' WindowName: 'Halifax UK | Bank Accounts, Savings, Loans & Mortgages'
- ClassName: 'Chrome_WidgetWin_0' WindowName: 'Log in to online banking - Google Chrome'
- ClassName: 'IEFrame' WindowName: 'Barclays Personal Banking | ISAs | Barclays latest ISA rates - Barclays - Microsoft Internet Explorer'
- ClassName: '{1C03B488-D53B-4a81-97F8-754559640193}' WindowName: 'Verified by Visa - Google Chrome'
- ClassName: 'Chrome_WidgetWin_0' WindowName: 'Verified by Visa - Google Chrome'
- ClassName: 'MozillaWindowClass' WindowName: 'Barclays Personal Banking | ISAs | Barclays latest ISA rates - Barclays - Mozilla Firefox'
- ClassName: 'MozillaUIWindowClass' WindowName: 'Barclays Personal Banking | ISAs | Barclays latest ISA rates - Barclays - Mozilla Firefox'
- ClassName: 'IEFrame' WindowName: 'Barclays Personal Banking | ISAs | Barclays latest ISA rates - Barclays - Windows Internet Explorer'
- ClassName: 'IEFrame' WindowName: 'Verified by Visa - Barclays - Microsoft Internet Explorer'
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MozillaWindowClass' WindowName: 'Verified by Visa - Mozilla Firefox'
- ClassName: 'MozillaUIWindowClass' WindowName: 'Verified by Visa - Mozilla Firefox'
- ClassName: 'IEFrame' WindowName: 'Verified by Visa - Barclays - Windows Internet Explorer'
- ClassName: 'IEFrame' WindowName: 'Log in to online banking - Microsoft Internet Explorer'
- ClassName: '{1C03B488-D53B-4a81-97F8-754559640193}' WindowName: 'Santander Online Banking - Google Chrome'
- ClassName: 'Chrome_WidgetWin_0' WindowName: 'Santander Online Banking - Google Chrome'
- ClassName: 'MozillaWindowClass' WindowName: 'Log in to online banking - Mozilla Firefox'
- ClassName: 'MozillaUIWindowClass' WindowName: 'Log in to online banking - Mozilla Firefox'
- ClassName: 'IEFrame' WindowName: 'Log in to online banking - Windows Internet Explorer'
- ClassName: 'IEFrame' WindowName: 'Santander Online Banking - Microsoft Internet Explorer'
- ClassName: '{1C03B488-D53B-4a81-97F8-754559640193}' WindowName: 'Barclays Personal Banking | ISAs | Barclays latest ISA rates - Barclays - Google Chrome'
- ClassName: 'Chrome_WidgetWin_0' WindowName: 'Barclays Personal Banking | ISAs | Barclays latest ISA rates - Barclays - Google Chrome'
- ClassName: 'MozillaWindowClass' WindowName: 'Santander Online Banking - Mozilla Firefox'
- ClassName: 'MozillaUIWindowClass' WindowName: 'Santander Online Banking - Mozilla Firefox'
- ClassName: 'IEFrame' WindowName: 'Santander Online Banking - Windows Internet Explorer'
