BKDR_GLUPTEBA.YVG

Führt Befehle eines externen, böswilligen Benutzers aus, wodurch das betroffene System gefährdet wird. Verbindet sich mit einer Website, um Daten zu versenden und zu empfangen.

Installation

Schleust die folgenden Eigenkopien in das betroffene System ein und führt sie aus:

• %AppDataLocal%\NVIDA Corporation\Updates\NvdUpd.exe

Fügt die folgenden Mutexe hinzu, damit nur jeweils eine ihrer Kopien ausgeführt wird:

• MD7H82HHF7EH2D73

Autostart-Technik

Fügt folgende Registrierungseinträge hinzu, um bei jedem Systemstart automatisch ausgeführt zu werden.

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NvUpdSrv = %AppDataLocal%\NVIDIA Corporation\Updates\NvdUpd.exe

Andere Systemänderungen

Fügt die folgenden Registrierungsschlüssel hinzu:

HKEY_CURRENT_USER\Software\NVIDIA Corporation

HKEY_CURRENT_USER\Software\NVIDIA Corporation\
Global

HKEY_CURRENT_USER\Software\NVIDIA Corporation\
Global\nvUpdSrv

Fügt die folgenden Registrierungseinträge hinzu:

HKEY_CURRENT_USER\Software\NVIDIA Corporation\
Global\nvUpdSrv
value = {installed version of malware which is "21150727"}

HKEY_CURRENT_USER\Software\NVIDIA Corporation\
Global\nvUpdSrv
GUID = {GUID}

HKEY_CURRENT_USER\Software\NVIDIA Corporation\
Global\nvUpdSrv
svalue = {random characters}

Backdoor-Routine

Führt die folgenden Befehle eines externen, böswilligen Benutzers aus:

• Creates a proxy connection
• Gather information from past created proxy connection
• Close socket of proxy connection
• Modify its added registry entries value and svalue
• Download and execute arbitrary file

Verbindet sich mit den folgenden Websites, um Daten zu versenden und zu empfangen.

• {BLOCKED}.{BLOCKED}.97.157:58186
• {BLOCKED}.{BLOCKED}.200.153:17513
• {BLOCKED}.{BLOCKED}.227.210:45297
• {BLOCKED}.{BLOCKED}.14.98:51917
• {BLOCKED}.{BLOCKED}.243.115:25603
• {BLOCKED}.{BLOCKED}.176.249:52112
• {BLOCKED}.{BLOCKED}.150.34:38862
• {BLOCKED}.{BLOCKED}.160.173:12131
• {BLOCKED}.{BLOCKED}.253.1:22357
• {BLOCKED}.{BLOCKED}.201.53:20075
• {BLOCKED}.{BLOCKED}.130.17:11263
• {BLOCKED}.{BLOCKED}.98.2:51376
• {BLOCKED}.{BLOCKED}.223.4:57578
• {BLOCKED}.{BLOCKED}.36.128:15206
• {BLOCKED}.{BLOCKED}.36.253:51376
• {BLOCKED}.{BLOCKED}.66.242:27042
• {BLOCKED}.{BLOCKED}.55.90:45297
• {BLOCKED}.{BLOCKED}.59.146:45297
• {BLOCKED}.{BLOCKED}.25.185:59981
• {BLOCKED}.{BLOCKED}.21.1:33679
• {BLOCKED}.{BLOCKED}.48.8:37007
• {BLOCKED}.{BLOCKED}.94.44:31588
• {BLOCKED}.{BLOCKED}.10.194:34409
• {BLOCKED}.{BLOCKED}.131.170:45370
• {BLOCKED}.{BLOCKED}.167.242:15745
• {BLOCKED}.{BLOCKED}.33.126:42386
• {BLOCKED}.{BLOCKED}.138.38:51376
• {BLOCKED}.{BLOCKED}.57.216:39106
• {BLOCKED}.{BLOCKED}.216.108:51376
• {BLOCKED}.{BLOCKED}.125.65:18703
• {BLOCKED}.{BLOCKED}.242.114:29342
• {BLOCKED}.{BLOCKED}.71.36:22508
• {BLOCKED}.{BLOCKED}.208.11:32965
• {BLOCKED}.{BLOCKED}.189.121:26195
• {BLOCKED}.{BLOCKED}.196.144:20480
• {BLOCKED}.{BLOCKED}.25.8:40406
• {BLOCKED}.{BLOCKED}.103.43:58207
• {BLOCKED}.{BLOCKED}.147.29:33376
• {BLOCKED}.{BLOCKED}.73.240:27936
• {BLOCKED}.{BLOCKED}.66.66:45297
• {BLOCKED}.{BLOCKED}.204.220:53986
• {BLOCKED}.{BLOCKED}.141.2:40443
• {BLOCKED}.{BLOCKED}.69.212:53129
• {BLOCKED}.{BLOCKED}.78.145:39632
• {BLOCKED}.{BLOCKED}.58.68:23480
• {BLOCKED}.{BLOCKED}.90.15:45297
• {BLOCKED}.{BLOCKED}.49.22:12410
• {BLOCKED}.{BLOCKED}.151.70:23370
• {BLOCKED}.{BLOCKED}.210.72:35607
• {BLOCKED}.{BLOCKED}.37.210:49994
• {BLOCKED}.{BLOCKED}.56.11:19141
• {BLOCKED}.{BLOCKED}.119.203:34373
• {BLOCKED}.{BLOCKED}.2.130:10557
• {BLOCKED}.{BLOCKED}.74.150:31973
• {BLOCKED}.{BLOCKED}.87.184:49205
• {BLOCKED}.{BLOCKED}.251.29:16493
• {BLOCKED}.{BLOCKED}.130.99:17325
• {BLOCKED}.{BLOCKED}.216.19:44573
• {BLOCKED}.{BLOCKED}.80.46:25127
• {BLOCKED}.{BLOCKED}.211.223:59138
• {BLOCKED}.{BLOCKED}.114.80:26093
• {BLOCKED}.{BLOCKED}.113.81:10934
• {BLOCKED}.{BLOCKED}.119.218:37127
• {BLOCKED}.{BLOCKED}.233.149:35173
• {BLOCKED}.{BLOCKED}.171.130:13586
• {BLOCKED}.{BLOCKED}.77.28:27190
• {BLOCKED}.{BLOCKED}.53.165:34549
• {BLOCKED}.{BLOCKED}.39.114:19650
• {BLOCKED}.{BLOCKED}.54.133:31189
• {BLOCKED}.{BLOCKED}.154.220:53818
• {BLOCKED}.{BLOCKED}.224.22:39976
• {BLOCKED}.{BLOCKED}.27.43:28731
• {BLOCKED}.{BLOCKED}.56.90:10703
• {BLOCKED}.{BLOCKED}.62.4:16660
• {BLOCKED}.{BLOCKED}.88.151:24423
• {BLOCKED}.{BLOCKED}.11.117:20357
• {BLOCKED}.{BLOCKED}.229.240:43992
• {BLOCKED}.{BLOCKED}.188.228:30708
• {BLOCKED}.{BLOCKED}.240.170:25338
• {BLOCKED}.{BLOCKED}.102.111:46975
• {BLOCKED}.{BLOCKED}.85.118:49126
• {BLOCKED}.{BLOCKED}.241.7:37399
• {BLOCKED}.{BLOCKED}.70.56:38271
• {BLOCKED}.{BLOCKED}.183.94:49721
• {BLOCKED}.{BLOCKED}.175.170:49996
• {BLOCKED}.{BLOCKED}.119.178:19069
• {BLOCKED}.{BLOCKED}.119.1:35535
• {BLOCKED}.{BLOCKED}.175.34:35638
• {BLOCKED}.{BLOCKED}.138.200:18150
• {BLOCKED}.{BLOCKED}.77.246:51841
• {BLOCKED}.{BLOCKED}.252.192:51964
• {BLOCKED}.{BLOCKED}.40.93:29037
• {BLOCKED}.{BLOCKED}.0.216:37288
• {BLOCKED}.{BLOCKED}.35.140:28103
• {BLOCKED}.{BLOCKED}.41.63:49996
• {BLOCKED}.{BLOCKED}.172.134:36822
• {BLOCKED}.{BLOCKED}.222.1:33879
• {BLOCKED}.{BLOCKED}.203.86:11908
• {BLOCKED}.{BLOCKED}.208.91:14229
• {BLOCKED}.{BLOCKED}.246.180:50007
• {BLOCKED}.{BLOCKED}.246.47:51117
• {BLOCKED}.{BLOCKED}.171.78:59899
• {BLOCKED}.{BLOCKED}.133.248:46856