Technical Information
Malicious functions:
Searches for windows to
detect analytical utilities:
- ClassName: '', WindowName: 'Fiddler - HTTP Debugging Proxy'
Modifies file system:
Creates the following files:
- %TEMP%\~DFA06A.tmp
- <SYSTEM32>\MSWINSCK.OCX
- <SYSTEM32>\MSINET.OCX
Deletes the following files:
- <DRIVERS>\etc\hosts
Substitutes the HOSTS file.
Network activity:
Connects to:
- 'pa###bin.com':443
- 'localhost':1037
UDP:
- DNS ASK pa###bin.com
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'WinHex'
- ClassName: '' WindowName: 'FlexHex'
- ClassName: '' WindowName: 'Resource Hacker'
- ClassName: '' WindowName: 'OllyDbg'
- ClassName: '' WindowName: 'idag'
- ClassName: '' WindowName: 'Starting Fiddler...'
- ClassName: '' WindowName: 'Charles 3.9.3.'
- ClassName: '' WindowName: 'Process Hacker'
- ClassName: '' WindowName: 'Uspack'
- ClassName: '' WindowName: 'Cheat Engine'
