Technical Information
Malicious functions
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Network activity
TCP
HTTP GET requests
- http://bo####egends.com/forum/
- http://ez###tway.com/gs_manager/uploads/products/cf-eft/images/eft.jpg
- http://ez###tway.com/gs_manager/uploads/products/cf-spoof/images/spoof.png
- http://bo####egends.com/forum/uploads/set_resources_3/1380d1eb0e6b9ccafef9e224828b6b4a_mainPattern.png
- http://bo####egends.com/forum/uploads/monthly_2020_03/photo-thumb-1.thumb.jpg.f18146174dbef18f339aebf966db652f.jpg
- http://bo####egends.com/forum/uploads/monthly_2020_03/log2o.png.8a7f4973e79cf9719fe0d4501ee4d039.png
- http://bo####egends.com/forum/applications/core/interface/font/fontawesome-webfont.eot
- http://bo####egends.com/forum/applications/core/interface/font/icomoon.eot
- http://bo####egends.com/forum/uploads/javascript_global/root_map.js.f17f0e9aefd0b5bd039cc3bded619b5b.js?v=##########
- http://bo####egends.com/forum/uploads/javascript_forums/front_front_forum.js.8427f6e0f33694c9f5680d126491de0c.js?v=##########
- http://bo####egends.com/forum/uploads/javascript_global/root_front.js.54931265cab3e46b2f5feeb4ebe2b9a0.js?v=##########
- http://bo####egends.com/forum/uploads/javascript_bimchatbox/front_front_chatbox.js.028223ae5416b2c6280ddcc2c174bd6f.js?v=##########
- http://bo####egends.com/forum/uploads/javascript_core/global_global_core.js.ba5ebe31bd5f5ea40d72a67da95a6237.js?v=##########
- http://bo####egends.com/forum/uploads/javascript_global/root_framework.js.a31f6024ddc72135ae173b6d56fe2eb8.js?v=##########
- http://bo####egends.com/forum/uploads/javascript_global/root_js_lang_1.js.baf054a403137bd651ce1270960032f7.js?v=##########
- http://bo####egends.com/forum/uploads/javascript_global/root_library.js.e1c7c3031fa4ca0303069312abe33378.js?v=##########
- http://bo####egends.com/forum/uploads/css_built_3/258adbb6e4f3e83cd3b355f84e3fa002_custom.css.397e54383b712521db0d286c28021acd.css?v=##########
- http://bo####egends.com/forum/uploads/css_built_3/76e62c573090645fb99a15a363d8620e_forums_responsive.css.2981585df13f3764d3fb77b782ad74c6.css?v=##########
- http://bo####egends.com/forum/uploads/css_built_3/62e269ced0fdab7e30e026f1d30ae516_forums.css.9d6032eab496e4e8c97ee0b4f4f2f113.css?v=##########
- http://bo####egends.com/forum/uploads/css_built_3/5a0da001ccc2200dc5625c3f3934497d_core_responsive.css.a0bcdea36c560ff68c6b6abb73e85e75.css?v=##########
- http://bo####egends.com/forum/uploads/css_built_3/90eb5adf50a8c640f633d47fd7eb1778_core.css.7038b5006ceb015a726640e4bd81c987.css?v=##########
- http://bo####egends.com/forum/uploads/css_built_3/ec0c06d47f161faa24112e8cbf0665bc_chatbox.css.a9afe695e2ca67415f0d9d1aee53e8b1.css?v=##########
- http://bo####egends.com/forum/uploads/css_built_3/05e81b71abe4f22d6eb8d1a929494829_responsive.css.03d521dfda85cf5ba02e2d1aa28b35fb.css?v=##########
- http://bo####egends.com/forum/uploads/css_built_3/341e4a57816af3ba440d891ca87450ff_framework.css.209f320def433c676ac4f2afb7156ce0.css?v=##########
- http://bo####egends.com/forum/applications/core/interface/html5shiv/html5shiv.js
- http://bo####egends.com/forum/uploads/css_built_3/5e61784858ad3c11f00b5706d12afe52_ie8.css.cf3a1ef171d7822cd716ea64cc46ff8c.css
- http://ez###tway.com/gs_manager/uploads/products/cf-r6/images/r6.png
- http://ez###tway.com/gs_manager/uploads/products/cf-apex/images/apex.jpg
UDP
- DNS ASK li####.iptime.org
- DNS ASK bo####egends.com
- DNS ASK ez###tway.com
Miscellaneous
Searches for the following windows
- ClassName: '18467-41' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: '' WindowName: 'Alert'
