BKDR_NUKESPED.E

Se ejecuta y, a continuación, se elimina.

Elimina archivos para impedir la ejecución correcta de programas y aplicaciones.

Ejecuta comandos desde un usuario remoto malicioso que pone en peligro el sistema afectado.

Instalación

Infiltra los archivos siguientes:

• %User Temp%\Microsoft.Win32.TaskScheduler.dll -> component for SetTaskPathDl
• %User Temp%\drmanidd32.dll ->also detected as BKDR_NUKESPED.E
• %Application Data%\Adobe\Update\SecuUpdates.dll -> renamed copy of drmanidd32.dll

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000, XP y Server 2003 suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp).

Infiltra y ejecuta los archivos siguientes:

• %User Temp%\end.bat -> used to delete itself and the malware
• %User Temp%\start.bat -> used to execute and delete components
• %User Temp%\SetTaskPathDl.exe ->used to rename and create a scheduled task for drmanidd32.dll

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000, XP y Server 2003 suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp).

Se ejecuta y, a continuación, se elimina.

Agrega las siguientes exclusiones mutuas para garantizar que solo se ejecuta una de sus copias en todo momento:

• 74tw9401-719s-85hk-op16-562ge02bm369

Otras modificaciones del sistema

Elimina los archivos siguientes:

• %User Temp%\end.bat
• %User Temp%\start.bat
• %User Temp%\SetTaskPathDl.exe
• %User Temp%\Microsoft.Win32.TaskScheduler.dll
• %User Temp%\drmanidd32.dll

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000, XP y Server 2003 suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp).

Rutina de puerta trasera

Ejecuta los comandos siguientes desde un usuario remoto malicioso:

• go -> Ok signal for the backdoor capability
• ti -> Change Sleep time multiplier
• sh -> Has same template as fs and ts but has not implemented any function after resolving the host address
• fs -> Send and Receive Backdoor Commands via UDT Library (UDT::socket, UDT::connect, etc)
  Has the following subcommands:
  • _dir Send a directory listing for path specified
  • _exe Execute arbitrary shell commands via WinExec
  • _get Encrypt and upload arbitrary file
  • _got Encrypt and upload arbitrary file then delete file
  • _put Download, Decrypt and save arbitrary file
  • _quit Exit “fs” backdoor command loop
• ts -> Send and Receive Backdoor Commands via common APIs (socket, bind, connect, etc)
  Has the following subcommands:
  • _dir Send a directory listing for path specified
  • _del Delete arbitray file
  • _exe Execute arbitrary shell commands via WinExec
  • _get Encrypt and upload arbitrary file
  • _got Encrypt and upload arbitrary file then delete file
  • _put Download, Decrypt and save arbitrary file
  • _dll Inject a DLL into a process via remote thread
  • _dlu Unload DLL
  • _cap Save screenshot to file and send to C&C, then delete
  • _inf Gather info to a temp file and Send to C&C, then delete:
    • Operating system version
    • Username
    • Computer name
    • System drive
    • Local time
    • All connected drives and properties
    • Network adapter properties
    • Disk free space
    • All installed programs
  • _cmd Execute comspec with arbitrary parameter and send results to C&C
  • _prc Send a full running process list to C&C
  • _quit Exit backdoor command thread
• dl -> DLL Injection via CreateRemoteThread
• du -> DLL Unloading via FreeLibrary
• de -> Secure Delete File Function, renames multiple times then delete
• cm -> Execute ComSpec with Arbitrary Parameters
• cu -> Send sytem info through the DNS query
• ex -> Execute Arbitrary Shell Commands