Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Tunneling Netlogon Sharing] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Tunneling Netlogon Sharing] 'ImagePath' = 'C:\nctgrablguqonai\oeeneaxr.exe'
Creates the following services
- 'Tunneling Netlogon Sharing' C:\nctgrablguqonai\oeeneaxr.exe
Modifies file system
Creates the following files
- %WINDIR%\nctgrablguqonai\n5pcfs4awmz
- C:\nctgrablguqonai\n5pcfs4awmz
- C:\nctgrablguqonai\dnpyl6ykwcfnorisejtd.exe
- C:\nctgrablguqonai\oeeneaxr.exe
- C:\nctgrablguqonai\oiyyebqawtv.exe
- C:\nctgrablguqonai\uargsn9wz
Sets the 'hidden' attribute to the following files
- C:\nctgrablguqonai\oeeneaxr.exe
- C:\nctgrablguqonai\oiyyebqawtv.exe
Deletes the following files
- %WINDIR%\nctgrablguqonai\n5pcfs4awmz
- C:\nctgrablguqonai\dnpyl6ykwcfnorisejtd.exe
Substitutes the following files
- %WINDIR%\nctgrablguqonai\n5pcfs4awmz
Network activity
Connects to
- 'he###finger.net':80
- 'pl#####tshoulder.net':80
- 'he###nabove.net':80
- 'jo####ybottom.net':80
- 'li###ebeing.net':80
- 'be####beyond.net':80
- 'ch####orever.net':80
- 'fo###tbeing.net':80
- 'in####sebottom.net':80
- 'li####flower.net':80
TCP
HTTP GET requests
- http://he###finger.net/index.php
- http://pl#####tshoulder.net/index.php
- http://he###nabove.net/index.php
- http://jo####ybottom.net/index.php
- http://li###ebeing.net/index.php
- http://be####beyond.net/index.php
- http://ch####orever.net/index.php
- http://fo###tbeing.net/index.php
- http://in####sebottom.net/index.php
- http://li####flower.net/index.php
UDP
- DNS ASK an###runtil.net
- DNS ASK su####bottom.net
- DNS ASK ef####beyond.net
- DNS ASK th####hbeyond.net
- DNS ASK ef###tbeing.net
- DNS ASK th####hbeing.net
- DNS ASK ef####forever.net
- DNS ASK ef####bottom.net
- DNS ASK in####seforever.net
- DNS ASK th####hbottom.net
- DNS ASK fo####beyond.net
- DNS ASK in####sebeyond.net
- DNS ASK fo###tbeing.net
- DNS ASK in####sebeing.net
- DNS ASK fo####forever.net
- DNS ASK wi####bottom.net
- DNS ASK th####hforever.net
- DNS ASK su####forever.net
- DNS ASK th###being.net
- DNS ASK be####forever.net
- DNS ASK ri####bottom.net
- DNS ASK be####bottom.net
- DNS ASK ch###beyond.net
- DNS ASK th###beyond.net
- DNS ASK ch###being.net
- DNS ASK ch####orever.net
- DNS ASK su###rbeing.net
- DNS ASK th####orever.net
- DNS ASK ch###bottom.net
- DNS ASK th###bottom.net
- DNS ASK wi####beyond.net
- DNS ASK su####beyond.net
- DNS ASK wi###nbeing.net
- DNS ASK wi####forever.net
- DNS ASK jo####yflower.net
- DNS ASK th###flower.net
- DNS ASK wo###beyond.net
- DNS ASK li####minute.net
- DNS ASK de####yspecial.net
- DNS ASK li####special.net
- DNS ASK de####ycorner.net
- DNS ASK li####corner.net
- DNS ASK ri####flower.net
- DNS ASK ri####minute.net
- DNS ASK in####sebottom.net
- DNS ASK be####minute.net
- DNS ASK ri####special.net
- DNS ASK be####special.net
- DNS ASK ri####corner.net
- DNS ASK be####corner.net
- DNS ASK ch###flower.net
- DNS ASK de####yminute.net
- DNS ASK ri####forever.net
- DNS ASK li####flower.net
- DNS ASK re####erbottom.net
- DNS ASK re####erbeyond.net
- DNS ASK wo###being.net
- DNS ASK re####erbeing.net
- DNS ASK wo####orever.net
- DNS ASK re####erforever.net
- DNS ASK wo###bottom.net
- DNS ASK fo####bottom.net
- DNS ASK hu####dcorner.net
- DNS ASK hu####dflower.net
- DNS ASK jo####yminute.net
- DNS ASK hu####dminute.net
- DNS ASK jo####yspecial.net
- DNS ASK hu####dspecial.net
- DNS ASK jo####ycorner.net
- DNS ASK de####yflower.net
- DNS ASK be####flower.net
- DNS ASK be###gbeing.net
- DNS ASK li####beyond.net
- DNS ASK ne####aryabove.net
- DNS ASK pl#####tshoulder.net
- DNS ASK ne#####ryshoulder.net
- DNS ASK pl####ntfinger.net
- DNS ASK ne####aryfinger.net
- DNS ASK or###until.net
- DNS ASK or###above.net
- DNS ASK he###nuntil.net
- DNS ASK re####eabove.net
- DNS ASK or####houlder.net
- DNS ASK re####eshoulder.net
- DNS ASK or###finger.net
- DNS ASK re####efinger.net
- DNS ASK le###runtil.net
- DNS ASK pl####ntabove.net
- DNS ASK re####euntil.net
- DNS ASK ne####aryuntil.net
- DNS ASK gl###finger.net
- DNS ASK gl###until.net
- DNS ASK an###rabove.net
- DNS ASK gl###above.net
- DNS ASK an####shoulder.net
- DNS ASK gl####houlder.net
- DNS ASK an####finger.net
- DNS ASK di####ultuntil.net
- DNS ASK he###finger.net
- DNS ASK he###until.net
- DNS ASK di####ultabove.net
- DNS ASK he###above.net
- DNS ASK di#####ltshoulder.net
- DNS ASK he####houlder.net
- DNS ASK di####ultfinger.net
- DNS ASK pl####ntuntil.net
- DNS ASK va####suntil.net
- DNS ASK be####beyond.net
- DNS ASK le####shoulder.net
- DNS ASK hu####dbeing.net
- DNS ASK jo####yforever.net
- DNS ASK hu####dforever.net
- DNS ASK jo####ybottom.net
- DNS ASK hu####dbottom.net
- DNS ASK de####ybeyond.net
- DNS ASK de####ybeing.net
- DNS ASK he###nabove.net
- DNS ASK li###ebeing.net
- DNS ASK de####yforever.net
- DNS ASK li####forever.net
- DNS ASK de####ybottom.net
- DNS ASK li####bottom.net
- DNS ASK ri####beyond.net
- DNS ASK jo####ybeing.net
- DNS ASK ri###nbeing.net
- DNS ASK hu####dbeyond.net
- DNS ASK ge####finger.net
- DNS ASK he####shoulder.net
- DNS ASK le####finger.net
- DNS ASK he####finger.net
- DNS ASK ge###euntil.net
- DNS ASK ge###eabove.net
- DNS ASK ge####shoulder.net
- DNS ASK le###rabove.net
- DNS ASK re####finger.net
- DNS ASK re###nuntil.net
- DNS ASK va####sabove.net
- DNS ASK re###nabove.net
- DNS ASK va####sshoulder.net
- DNS ASK re####shoulder.net
- DNS ASK va####sfinger.net
- DNS ASK jo####ybeyond.net
- DNS ASK ch###minute.net
Miscellaneous
Creates and executes the following
- 'C:\nctgrablguqonai\dnpyl6ykwcfnorisejtd.exe'
- 'C:\nctgrablguqonai\oeeneaxr.exe'
- 'C:\nctgrablguqonai\oiyyebqawtv.exe' "c:\nctgrablguqonai\oeeneaxr.exe"
