Technical Information
Malicious functions:
Installs hooks to intercept notifications
on keystrokes:
- Handler for all processes: <Current directory>\cfgdll.dll
Modifies file system :
Creates the following files:
- %APPDATA%\qmacro\qdisp.dll
- <Current directory>\cfgdll.dll
- %TEMP%\ad-mymacro8.xml
- %TEMP%\adcon\mm\tmpad.xml
- %TEMP%\adcon\mm\liveupdate8.dat.tmp
- %TEMP%\85e3.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\liveupdate8[1].dat
- %TEMP%\mymacro.zip
- %TEMP%\plugin.zip
- <Current directory>\plugin\WINDOW.DLL
- %TEMP%\1.tmp
- %TEMP%\2.tmp
- <Current directory>\plugin\FILE.DLL
- <Current directory>\plugin\MSG.DLL
- <Current directory>\plugin\SYS.DLL
- <Current directory>\plugin\GETSYSINFO.DLL
Deletes the following files:
- %TEMP%\adcon\mm\tmpad.xml
- %TEMP%\mymacro.zip
- %TEMP%\plugin.zip
Moves the following files:
- from %TEMP%\adcon\mm\liveupdate8.dat.tmp to %TEMP%\adcon\mm\liveupdate8.dat
Network activity:
Connects to:
- 'do##.#rbrothers.com':80
- 'localhost':1036
TCP:
HTTP GET requests:
- do##.#rbrothers.com/qmacro/up_mymacro/liveupdate8.dat
UDP:
- DNS ASK hi.###rothers.com
- DNS ASK ad.###rothers.com
- DNS ASK do##.#rbrothers.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
