Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\hidetoolz] 'ImagePath' = '<DRIVERS>\hidetoolz.sys'
Modifies file system:
Creates the following files:
- <DRIVERS>\hidetoolz.sys
Network activity:
Connects to:
- 'hi###oolz.com':80
- 'localhost':1039
TCP:
HTTP GET requests:
- http://www.hi###oolz.com/game.html via hi###oolz.com
UDP:
- DNS ASK www.hi###oolz.com
- '<DNS_SERVER>':1047
- '11#.#14.114.114':1046
- '<DNS_SERVER>':1048
- '<DNS_SERVER>':1050
- '11#.#14.114.114':1049
- '18#.#6.76.76':1045
- '18#.#6.76.76':1038
- '18#.#6.76.76':1037
- '18#.#6.76.76':1041
- '11#.#14.114.114':1044
- '11#.#14.114.114':1042
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
