The developer decided to remove the MFC library and put almost all the code in a unique function. The number of functions is divided by three. If the target would have a proxy, the malware would not be able to communicate outside. The attacker retrieves the proxy configuration in the registry: The network communication is divided in two parts. The first part uses the Microsoft Windows Wininet library. The purpose is to send reconnaissance information to the attackers. The malware sent to the operator the following information: the campaign ID (named Flag by the developer), the hostname of the compromised system, the IP address, the OS version, the proxy server of the system and if the system is running on VMware. To get this information, the attacker the VMXh-Magic-Value (0x0a). The second part of the communication is dedicated to the orders and the exfiltration. You can see in the screenshot 0x4E3 (1251 - Cyrillic Russian) and 0x362 (866 - DOS Cyrillic Russian): Sha256: 43606116e03672d5c2bca7d072caa573d3fc2463795427d6f5abfa25403bd280 C2 for the orders: dnsdns1[.]PassAs[.]us C2 URL for reconnaissance: hxxp://fund[.]cmc[.]or[.]kr/UploadFile/fame/x/o0.asp