BKDR_GLUPTEBA.YVA

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor adds the following mutexes to ensure that only one of its copies runs at any one time:

• MD7H82HHF7EH2D73

Other System Modifications

This backdoor adds the following registry keys:

HKEY_CURRENT_USER\SOFTWARE\NVIDIA Corporation\
Global\nvUpdSrv

It adds the following registry entries:

HKEY_CURRENT_USER\Software\NVIDIA Corporation\
Global\nvUpdSrv
value = {installed version of malware which is "21150503"}

HKEY_CURRENT_USER\Software\NVIDIA Corporation\
Global\nvUpdSrv
GUID = {GUID}

HKEY_CURRENT_USER\Software\NVIDIA Corporation\
Global\nvUpdSrv
svalue = {random characters}

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Creates a proxy connection
• Gather information from past created proxy connection
• Close socket of proxy connection
• Modify the value on the previously added registry:
• {value}, which is the version; and {svalue}, which is the encrypted C&C list
• Download and execute a file from URL

Download Routine

This backdoor connects to the following URL(s) to download its component file(s):

• {BLOCKED}.{BLOCKED}.96.102:37174
• {BLOCKED}.{BLOCKED}.201.43:17659
• {BLOCKED}.{BLOCKED}.208.82:45297
• {BLOCKED}.{BLOCKED}.224.26:32136
• {BLOCKED}.{BLOCKED}.42.114:25127
• {BLOCKED}.{BLOCKED}.52.26:23097
• {BLOCKED}.{BLOCKED}.163.194:60098
• {BLOCKED}.{BLOCKED}.103.78:36034
• {BLOCKED}.{BLOCKED}.160.173:12131
• {BLOCKED}.{BLOCKED}.253.1:22357
• {BLOCKED}.{BLOCKED}.7.65:21903
• {BLOCKED}.{BLOCKED}.19.171:57136
• {BLOCKED}.{BLOCKED}.96.151:31993
• {BLOCKED}.{BLOCKED}.98.2:49891
• {BLOCKED}.{BLOCKED}.36.128:15206
• {BLOCKED}.{BLOCKED}.56.247:11754
• {BLOCKED}.{BLOCKED}.140.15:16577
• {BLOCKED}.{BLOCKED}.22.66:22740
• {BLOCKED}.{BLOCKED}.31.250:38102
• {BLOCKED}.{BLOCKED}.55.90:45297
• {BLOCKED}.{BLOCKED}.56.202:45297
• {BLOCKED}.{BLOCKED}.205.155:22887
• {BLOCKED}.{BLOCKED}.205.163:25549
• {BLOCKED}.{BLOCKED}.148.43:49126
• {BLOCKED}.{BLOCKED}.237.81:19413
• {BLOCKED}.{BLOCKED}.105.138:38109
• {BLOCKED}.{BLOCKED}.167.242:15745
• {BLOCKED}.{BLOCKED}.84.82:35971
• {BLOCKED}.{BLOCKED}.79.158:58186
• {BLOCKED}.{BLOCKED}.79.200:33879
• {BLOCKED}.{BLOCKED}.73.175:58186
• {BLOCKED}.{BLOCKED}.71.36:22508
• {BLOCKED}.{BLOCKED}.208.11:32965
• {BLOCKED}.{BLOCKED}.189.121:26195
• {BLOCKED}.{BLOCKED}.177.4:18532
• {BLOCKED}.{BLOCKED}.103.43:58207
• {BLOCKED}.{BLOCKED}.59.2:26195
• {BLOCKED}.{BLOCKED}.138.226:31973
• {BLOCKED}.{BLOCKED}.66.66:45297
• {BLOCKED}.{BLOCKED}.78.26:52112
• {BLOCKED}.{BLOCKED}.58.68:23480
• {BLOCKED}.{BLOCKED}.192.230:26666
• {BLOCKED}.{BLOCKED}.108.1:40015
• {BLOCKED}.{BLOCKED}.150.2:33376
• {BLOCKED}.{BLOCKED}.192.31:25905
• {BLOCKED}.{BLOCKED}.99.100:30124
• {BLOCKED}.{BLOCKED}.137.149:23099
• {BLOCKED}.{BLOCKED}.200.157:52112
• {BLOCKED}.{BLOCKED}.37.210:49994
• {BLOCKED}.{BLOCKED}.117.197:28171
• {BLOCKED}.{BLOCKED}.188.2:48105
• {BLOCKED}.{BLOCKED}.24.234:45297
• {BLOCKED}.{BLOCKED}.87.184:49205
• {BLOCKED}.{BLOCKED}.115.196:21196
• {BLOCKED}.{BLOCKED}.218.14:45570
• {BLOCKED}.{BLOCKED}.80.46:25127
• {BLOCKED}.{BLOCKED}.113.81:10934
• {BLOCKED}.{BLOCKED}.212.34:51447
• {BLOCKED}.{BLOCKED}.67.170:53872
• {BLOCKED}.{BLOCKED}.77.28:27190
• {BLOCKED}.{BLOCKED}.180.232:53872
• {BLOCKED}.{BLOCKED}.180.243:33879
• {BLOCKED}.{BLOCKED}.181.123:27571
• {BLOCKED}.{BLOCKED}.67.39:24247
• {BLOCKED}.{BLOCKED}.154.220:53818
• {BLOCKED}.{BLOCKED}.56.90:10703
• {BLOCKED}.{BLOCKED}.1.90:11982
• {BLOCKED}.{BLOCKED}.1.171:22459
• {BLOCKED}.{BLOCKED}.223.12:49116
• {BLOCKED}.{BLOCKED}.107.132:19796
• {BLOCKED}.{BLOCKED}.11.117:20357
• {BLOCKED}.{BLOCKED}.104.139:18532
• {BLOCKED}.{BLOCKED}.209.207:53127
• {BLOCKED}.{BLOCKED}.209.137:37127
• {BLOCKED}.{BLOCKED}.231.223:43992
• {BLOCKED}.{BLOCKED}.110.162:37174
• {BLOCKED}.{BLOCKED}.85.118:49126
• {BLOCKED}.{BLOCKED}.118.22:48439
• {BLOCKED}.{BLOCKED}.118.90:35535
• {BLOCKED}.{BLOCKED}.70.56:38271
• {BLOCKED}.{BLOCKED}.20.226:54127
• {BLOCKED}.{BLOCKED}.59.99:30577
• {BLOCKED}.{BLOCKED}.132.233:39353
• {BLOCKED}.{BLOCKED}.119.1:35535
• {BLOCKED}.{BLOCKED}.151.109:54091
• {BLOCKED}.{BLOCKED}.138.200:18150
• {BLOCKED}.{BLOCKED}.134.140:19753
• {BLOCKED}.{BLOCKED}.77.246:51841
• {BLOCKED}.{BLOCKED}.45.29:22237
• {BLOCKED}.{BLOCKED}.20.202:36102
• {BLOCKED}.{BLOCKED}.188.250:48439
• {BLOCKED}.{BLOCKED}.195.47:59899
• {BLOCKED}.{BLOCKED}.41.63:49996
• {BLOCKED}.{BLOCKED}.223.98:53127
• {BLOCKED}.{BLOCKED}.146.114:27042
• {BLOCKED}.{BLOCKED}.133.248:46856

It saves the files it downloads using the following names:

• %User Temp%\nvu{random}.tmp.exe - it executes this file

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

NOTES:

This backdoor notifies the IP addresses mentioned above by sending the following HTTP GET request, and then waiting for further acknowledgement before downloading:

stat?uid={value}&downlink={value}&uplink={value}&id={value}&statpass={value}&version={installed version}&features={value}&guid={guid}&comment={value}&p={value}&s={value}

However, as of this writing the request attempts fail.

Because this backdoor is capable of creating proxy connections, it is able to use the infected computer as a relay to spam email sent originally by the C&C. The email it sends contains any of the following:

• A message inviting the reader to check out an online portfolio
• A link directing users to a dating/adult website
• An attractive picture that leads to a dating/adult website when users click on the said picture

The following are the websites accessed when users click on the link or the photo:

• https://www.{BLOCKED}crush.com
• https://www.{BLOCKED}ok.xxx
• https://www.{BLOCKED}t.net