Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'GoogleUpdate' = '"%ALLUSERSPROFILE%\Google\Update\GoogleUpdate.exe"'
Malicious functions
Intercepts control using hardware breakpoints
in NTDLL dll
- googleupdate.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\google\update\gupdater2.dll
- %ALLUSERSPROFILE%\google\update\googleupdate.exe
- %ALLUSERSPROFILE%\google\update\main.pid
- %ALLUSERSPROFILE%\google\update\cache\s.dat
- %ALLUSERSPROFILE%\google\update\g.pid
Deletes itself.
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\google\update\googleupdate.exe'
- '%ALLUSERSPROFILE%\google\update\googleupdate.exe' -d "<Full path to file>"
- '%ALLUSERSPROFILE%\google\update\googleupdate.exe' -g
