Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Identity Debugger Endpoint Isolation] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Identity Debugger Endpoint Isolation] 'ImagePath' = 'C:\nlnknotco\vujcbufaoke.exe'
Creates the following services
- 'Identity Debugger Endpoint Isolation' C:\nlnknotco\vujcbufaoke.exe
Modifies file system
Creates the following files
- %WINDIR%\nlnknotco\ggpf7qc8ah
- C:\nlnknotco\ggpf7qc8ah
- C:\nlnknotco\snn9bqcuydxqhuef.exe
- C:\nlnknotco\vujcbufaoke.exe
- C:\nlnknotco\ledidkgge.exe
- C:\nlnknotco\jnljkvs0mf
Sets the 'hidden' attribute to the following files
- C:\nlnknotco\vujcbufaoke.exe
- C:\nlnknotco\ledidkgge.exe
Deletes the following files
- %WINDIR%\nlnknotco\ggpf7qc8ah
- C:\nlnknotco\snn9bqcuydxqhuef.exe
Substitutes the following files
- %WINDIR%\nlnknotco\ggpf7qc8ah
Network activity
Connects to
- 'di#####ltcomplete.net':80
- 'va####swelcome.net':80
- 'an####govern.net':80
- 'gl####ompany.net':80
- 'ne#####ryfurther.net':80
UDP
- DNS ASK an####welcome.net
- DNS ASK he####needle.net
- DNS ASK le####enough.net
- DNS ASK he####enough.net
- DNS ASK le####govern.net
- DNS ASK he####govern.net
- DNS ASK he####nature.net
- DNS ASK le####needle.net
- DNS ASK ge####nature.net
- DNS ASK ge####govern.net
- DNS ASK va####snature.net
- DNS ASK re####nature.net
- DNS ASK va####sneedle.net
- DNS ASK re####needle.net
- DNS ASK ge####needle.net
- DNS ASK ge####enough.net
- DNS ASK le####nature.net
- DNS ASK re####egovern.net
- DNS ASK or###govern.net
- DNS ASK pl####ntnature.net
- DNS ASK ne####arynature.net
- DNS ASK pl####ntneedle.net
- DNS ASK ne####aryneedle.net
- DNS ASK pl####ntenough.net
- DNS ASK ne####aryenough.net
- DNS ASK he###govern.net
- DNS ASK pl####ntgovern.net
- DNS ASK or###nature.net
- DNS ASK re####enature.net
- DNS ASK or###needle.net
- DNS ASK re####eneedle.net
- DNS ASK or###enough.net
- DNS ASK re####eenough.net
- DNS ASK ne####arygovern.net
- DNS ASK va####senough.net
- DNS ASK va####sgovern.net
- DNS ASK re####efurther.net
- DNS ASK re####govern.net
- DNS ASK di####ultbecome.net
- DNS ASK he###become.net
- DNS ASK di#####ltcompany.net
- DNS ASK he####ompany.net
- DNS ASK pl####ntfurther.net
- DNS ASK di####ultcover.net
- DNS ASK he###cover.net
- DNS ASK ne#####ryfurther.net
- DNS ASK pl####ntbecome.net
- DNS ASK ne####arybecome.net
- DNS ASK pl####ntcompany.net
- DNS ASK ne#####rycompany.net
- DNS ASK or####urther.net
- DNS ASK pl####ntcover.net
- DNS ASK ne####arycover.net
- DNS ASK he####urther.net
- DNS ASK di#####ltfurther.net
- DNS ASK gl####ompany.net
- DNS ASK fo####dfurther.net
- DNS ASK de###ecover.net
- DNS ASK fo####dcover.net
- DNS ASK de####become.net
- DNS ASK fo####dbecome.net
- DNS ASK de####company.net
- DNS ASK de####further.net
- DNS ASK fo####dcompany.net
- DNS ASK gl####urther.net
- DNS ASK an###rcover.net
- DNS ASK gl###cover.net
- DNS ASK an####become.net
- DNS ASK gl###become.net
- DNS ASK an####company.net
- DNS ASK an####further.net
- DNS ASK di####ultgovern.net
- DNS ASK re####enough.net
- DNS ASK he###enough.net
- DNS ASK he####around.net
- DNS ASK ne####aryproud.net
- DNS ASK pl#####tcomplete.net
- DNS ASK ne#####rycomplete.net
- DNS ASK or####elcome.net
- DNS ASK re####ewelcome.net
- DNS ASK ne####aryaround.net
- DNS ASK pl####ntproud.net
- DNS ASK or###around.net
- DNS ASK re####eproud.net
- DNS ASK or####omplete.net
- DNS ASK re####ecomplete.net
- DNS ASK le####welcome.net
- DNS ASK he####welcome.net
- DNS ASK re####earound.net
- DNS ASK or###proud.net
- DNS ASK pl####ntaround.net
- DNS ASK ne#####rywelcome.net
- DNS ASK pl####ntwelcome.net
- DNS ASK an####around.net
- DNS ASK gl###around.net
- DNS ASK an###rproud.net
- DNS ASK gl###proud.net
- DNS ASK an####complete.net
- DNS ASK gl####omplete.net
- DNS ASK gl####elcome.net
- DNS ASK di#####ltwelcome.net
- DNS ASK di####ultaround.net
- DNS ASK he###around.net
- DNS ASK di####ultproud.net
- DNS ASK he###proud.net
- DNS ASK di#####ltcomplete.net
- DNS ASK he####omplete.net
- DNS ASK he####elcome.net
- DNS ASK le####around.net
- DNS ASK le###rproud.net
- DNS ASK he###needle.net
- DNS ASK he###nproud.net
- DNS ASK de####govern.net
- DNS ASK fo####dgovern.net
- DNS ASK an####nature.net
- DNS ASK gl###nature.net
- DNS ASK an####needle.net
- DNS ASK de####enough.net
- DNS ASK fo####denough.net
- DNS ASK gl###needle.net
- DNS ASK an####govern.net
- DNS ASK gl###govern.net
- DNS ASK di####ultnature.net
- DNS ASK he###nature.net
- DNS ASK di####ultneedle.net
- DNS ASK an####enough.net
- DNS ASK gl###enough.net
- DNS ASK fo####dneedle.net
- DNS ASK de####needle.net
- DNS ASK fo####dnature.net
- DNS ASK he####complete.net
- DNS ASK ge####welcome.net
- DNS ASK ge####around.net
- DNS ASK ge###eproud.net
- DNS ASK ge####complete.net
- DNS ASK va####swelcome.net
- DNS ASK le####complete.net
- DNS ASK re####welcome.net
- DNS ASK re####around.net
- DNS ASK va####sproud.net
- DNS ASK re###nproud.net
- DNS ASK va####scomplete.net
- DNS ASK re####complete.net
- DNS ASK de####nature.net
- DNS ASK va####saround.net
- DNS ASK di####ultenough.net
- DNS ASK or###cover.net
Miscellaneous
Creates and executes the following
- 'C:\nlnknotco\snn9bqcuydxqhuef.exe'
- 'C:\nlnknotco\vujcbufaoke.exe'
- 'C:\nlnknotco\ledidkgge.exe' "c:\nlnknotco\vujcbufaoke.exe"
