If you are looking for a specific research paper, it is likely indexed under its technical alias, , in cybersecurity databases like VirusTotal or Malwarebytes Labs [2, 4].

Academic and technical papers focusing on this malware generally classify it as a Researchers often use it as a case study for:

Once executed, it typically modifies the Windows Registry to ensure it runs at startup, hides system files, and attempts to disable security software [1, 4]. Technical Analysis (Summary)