Technical Information
Malicious functions:
Searches for windows to
detect analytical utilities:
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: 'ollydbg', WindowName: ''
Modifies file system:
Creates the following files:
- C:\cf230.dll
- C:\imedllhost09.dll
Sets the 'hidden' attribute to the following files:
- C:\cf230.dll
- C:\imedllhost09.dll
Network activity:
Connects to:
- 'www.to###iwg.com':80
- 'localhost':1040
TCP:
HTTP GET requests:
- http://www.to###iwg.com/
- http://www.to###iwg.com/xz.html
UDP:
- DNS ASK www.to###iwg.com
Miscellaneous:
Searches for the following windows:
- ClassName: '18467-41' WindowName: ''
- ClassName: 'SoftSnoopMainDialog' WindowName: ''
- ClassName: '4823-00000029' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: '' WindowName: 'Syser : Active Hotkey [Ctrl+F12]'
- ClassName: '' WindowName: 'Syser Debugger - Win32 User Mode Debugger'
- ClassName: 'WinDbgFrameClass' WindowName: ''
- ClassName: '' WindowName: 'Microsoft Spy++ - [ґ°їЪ 1]'
- ClassName: '' WindowName: 'Microsoft Spy++ - [???? 1]'
