Troj/Nebuler-Q is a Trojan for the Windows platform.
When Troj/Nebuler-Q is installed the following files are created:
<User>\Application Data\Microsoft\Crypto\rsa\S-1-5-21-842925246-562591055-725345543-1003\16f3371a170fa393a3bcbaa3c10a147b_b51db6e2-3a90-48f4-b2a9-edf389bedc4b
<User>\Application Data\Microsoft\Protect\S-1-5-21-842925246-562591055-725345543-1003\31d6e411-8efc-410c-b086-36e56005786c
<User>\Application Data\Microsoft\Protect\S-1-5-21-842925246-562591055-725345543-1003\Preferred
<User>\Application Data\Microsoft\Protect\credhist
<Temp>\gos1.bat
<System>\wingsc32.dll
The files wingsc32.dll and gos1.tmp are detected as Troj/Nebule-Gen.
The following registry entries are created to run code exported by wingsc32.dll on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wingsc32
DllName
wingsc32.dll
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wingsc32
Impersonate
0
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wingsc32
Startup
EvtStartup
Registry entries are created under:
HKLM\SOFTWARE\Microsoft\MSSMGR