Exploitation of CVE-2016-0167 a Microsoft Windows Privilege Escalation vulnerability to gain SYSTEM level privileges. Earlier versions of Shifu exploited CVE-2015-0003 to achieve the same goal. Use of a Windows atom to identify if the host is already infected with Shifu in addition to the mutex used by previous versions. Use of “push-calc-ret” API obfuscation to hide function calls from malware analysts. Use of alternative Namecoin .bit domains.