Analizzato da: Adrian Cofreros   
 Piattaforma:

Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)

 Valutazione del rischio complessivo:
 Potenziale dannoso: :
 Potenziale di distribuzione: :
 Reported Infection:
 Informazioni esposizione: :
Basso
Medio
Alto
Critico

  • Tipo di minaccia informatica:
    Backdoor

  • Distruttivo?:
    No

  • Crittografato?:
     

  • In the wild::
    Sì

  Panoramica e descrizione

Se ejecuta y, a continuación, se elimina.

  Dettagli tecnici

Dimensione file: 208,896 bytes
Tipo di file: EXE
Data di ricezione campioni iniziali: 23 febbraio 2013

Instalación

Infiltra los archivos siguientes:

  • %AppDataLocal%\Google\Desktop\Install\{GUID}\{incomprehensible path}\{GUID}\GoogleUpdate.exe
  • %AppDataLocal%\Google\Desktop\Install\{GUID}\{incomprehensible path}\{GUID}\@
  • %Program Files%\Google\Desktop\Install\{GUID}\{incomprehensible path}\{GUID}\GoogleUpdate.exe
  • %Program Files%\Google\Desktop\Install\{GUID}\{incomprehensible path}\{GUID}\@

(Nota: %Program Files% es la carpeta Archivos de programa predeterminada, que suele estar en C:\Archivos de programa).

)

Crea las carpetas siguientes:

  • %AppDataLocal%\Google\Desktop
  • %AppDataLocal%\Google\Desktop\Install
  • %AppDataLocal%\Google\Desktop\Install\{GUID}
  • %AppDataLocal%\Google\Desktop\Install\{GUID}\{incomprehensible path}
  • %AppDataLocal%\Google\Desktop\Install\{GUID}\{incomprehensible path}\{GUID}
  • %AppDataLocal%\Google\Desktop\Install\{GUID}\{incomprehensible path}\{GUID}\U
  • %AppDataLocal%\Google\Desktop\Install\{GUID}\{incomprehensible path}\{GUID}\L
  • %Program Files%\Google\Desktop
  • %Program Files%\Google\Desktop\Install
  • %Program Files%\Google\Desktop\Install\{GUID}
  • %Program Files%\Google\Desktop\Install\{GUID}\{incomprehensible path}
  • %Program Files%\Google\Desktop\Install\{GUID}\{incomprehensible path}\{GUID}
  • %Program Files%\Google\Desktop\Install\{GUID}\{incomprehensible path}\{GUID}\U
  • %Program Files%\Google\Desktop\Install\{GUID}\{incomprehensible path}\{GUID}\L

(Nota: %Program Files% es la carpeta Archivos de programa predeterminada, que suele estar en C:\Archivos de programa).

)

Se ejecuta y, a continuación, se elimina.

Otras modificaciones del sistema

Agrega las siguientes entradas de registro como parte de la rutina de instalación:

HKEY_LOCAL_MACHINE\SYSTEM\{CurrentControlSet}\
Services\{box character}etadpug

HKEY_LOCAL_MACHINE\SYSTEM\{CurrentControlSet}\
Services\{box character}etadpug\Parameters

Agrega las siguientes entradas de registro:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Google Update = "%AppDataLocal%\Google\Desktop\Install\{GUID}\{incomprehensible path 1}\{GUID}\GoogleUpdate.exe<"

HKEY_LOCAL_MACHINE\SYSTEM\{CurrentControlSet}\
Services\{box character}etadpug
Description = "Keeps your Google software up to date. If this service is disabled or stopped, your Google software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This service uninstalls itself when there is no Google software using it."

HKEY_LOCAL_MACHINE\SYSTEM\{CurrentControlSet}\
Services\{box character}etadpug
DisplayName = "Google Update Service (gupdate)"

HKEY_LOCAL_MACHINE\SYSTEM\{CurrentControlSet}\
Services\{box character}etadpug
ErrorControl = "0"

HKEY_LOCAL_MACHINE\SYSTEM\{CurrentControlSet}\
Services\{box character}etadpug
ImagePath = ""%Program Files%\Google\Desktop\Install\{GUID}\{incomprehensible path 1}\{GUID}\GoogleUpdate.exe" <"

HKEY_LOCAL_MACHINE\SYSTEM\{CurrentControlSet}\
Services\{box character}etadpug
ObjectName = "LocalSystem"

HKEY_LOCAL_MACHINE\SYSTEM\{CurrentControlSet}\
Services\{box character}etadpug
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\{CurrentControlSet}\
Services\{box character}etadpug
Type = "16"

HKEY_LOCAL_MACHINE\SYSTEM\{CurrentControlSet}\
Services\{box character}etadpug\Parameters
Parameters = "176"