Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\rLblQG] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\rLblQG] 'ImagePath' = '<SYSTEM32>\NdsBOr.exe Service 1'
Creates the following services
- 'rLblQG' <SYSTEM32>\NdsBOr.exe Service 1
Malicious functions
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\syswow64\ndsbor.exe
Modifies file system
Creates the following files
- %WINDIR%\syswow64\ndsbor.exe
Deletes itself.
Network activity
Connects to
- '15#.#40.108.157':2022
TCP
Other
- '15#.#40.108.157':2022
UDP
- 'localhost':62236
- 'localhost':52863
- 'localhost':62607
- 'localhost':58579
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\ndsbor.exe' -auto
- '%WINDIR%\syswow64\ndsbor.exe' Service 1
- '%WINDIR%\syswow64\ndsbor.exe' -OBJECT1
- '%WINDIR%\syswow64\cmd.exe' /c del <Full path to file> > nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c del <Full path to file> > nul
