Technical Information
Malicious functions:
Creates and executes the following:
- '' (downloaded from the Internet)
Modifies file system:
Creates the following files:
- <Current directory>\NetTimeSetup-314.exe
- <Current directory>\nettime.reg
- C:\programi\TightVNC.2\bios-up.exe
- %HOMEPATH%\Desktop\bios-up.lnk
Network activity:
Connects to:
- 'ti####nctool.com':80
- 'en###.##ndns-at-home.com':80
TCP:
HTTP GET requests:
- http://www.ti####nctool.com/NetTimeSetup-314.exe via ti####nctool.com
- http://en###.##ndns-at-home.com/mirror/NetTimeSetup-314.exe
UDP:
- DNS ASK www.ti####nctool.com
- DNS ASK en###.##ndns-at-home.com
Miscellaneous:
Creates and executes the following:
- '<Current directory>\NetTimeSetup-314.exe' /silent
Executes the following:
- '<SYSTEM32>\reg.exe' import nettime.reg
