Trojan:Win32/NukeSped

The Trojan:Win32/NukeSped infection chain typically begins when a user runs a seemingly legitimate file delivered through social engineering campaigns. These files often appear as job offers, skill assessments, or software installers relevant to the victim's professional interests. One documented delivery method uses Microsoft Word documents with malicious macro scripts. When macros are enabled, the document uses Windows Management Instrumentation to start the execution chain, dropping a first stage loader such as AlgStore.exe. This loader contacts a remote server to retrieve additional components. Another approach uses large installers around 30 MB that leverage the InstallShield engine. These installers drop configuration files and log files in temporary directories before executing the main malicious MSI package.  

The installer performs environment checks and only proceeds with component installation when it detects specific system conditions that suggest a genuine target rather than a sandbox. The loader components use encryption to protect the primary remote access payload. AlgStore.exe contains a resource section named "OTC" that stores the second stage binary in encrypted form. The loader uses a hardcoded decryption key "!zGYX*ei$%HrW9#a" to decode this payload and load it directly into process memory. This technique, known as reflective loading, allows the malware to run without creating a permanent file on the disk. Some variants take this further by using Living off the Land binaries to facilitate execution. The infection chain might involve wmiprvse.exe spawning mshta.exe, which then launches the first stage payload. This approach helps malicious activity blend with normal device operations.  

Once active, the remote access tool may inject code into stable Windows processes like explorer.exe or svchost.exe to maintain a long-term presence. Network communication implements several layers of protection. Many variants use a technique that mimics Transport Layer Security traffic while employing custom internal encryption. The malware initiates sessions using legitimate SSL certificates copied from well-known internet services, which helps deceive deep packet inspection tools. Internally, the malware protects data with a rotating XOR and ADD cipher. For data transmission, the malware transforms each byte using an exclusive OR operation with 0x47 followed by the addition of 0x28. For received data, the process reverses with an exclusive OR operation after subtracting 0x28. Command and control servers operate from diverse infrastructure, including compromised legitimate sites. Observed controller addresses include: 

• bug[.]restoroad[.]com (46[.]105[.]57[.]169) 
• hurricanepub[.]com (50[.]192[.]28[.]29) 
• turnscor[.]com (67[.]225[.]140[.]4) 
• coralsunmarine[.]com (23[.]111[.]133[.]162) 
• kazitradebd[.]com (104[.]21[.]80[.]1) 
• certix-z3[.]com (62[.]75[.]183[.]68) 
• 62[.]75[.]183[.]67 
• 78[.]11[.]12[.]13 
• 175[.]207[.]13[.]231 

A distinctive feature of some variants is the ability to transform infected hosts into proxy servers. This allows threat actors to use compromised machines as relay points, routing traffic between their operations and additional targets. The malware binds to a specific port such as 8000 and listens for incoming connections. To ensure only authorized operators can use the proxy, the malware implements an authentication handshake requiring a specific ASCII string "1qazXSDC23we". Connections that do not provide the correct string terminate immediately. After successful authentication, operators can issue secondary commands like "ghfghjuyufgdgftr" to initiate proxying functions. This modular approach allows threat actors to move through victim networks with greater control and reduced risk of detection. 

Persistence mechanisms ensure the malware survives Windows restarts. The malware installs services that run automatically at system startup, such as a service named UDPTrcSvc with display name "Network UDP Trace Management Service" configured to start automatically under the LocalSystem account. The service image path points to "%SystemRoot%\System32\svchost.exe -k mdnetuse". Registry modifications maintain execution through multiple paths. The malware adds entries to the Run keys including "MaliciousUpdater" pointing to files in the AppData Roaming folder and "VnrPack" pointing to malicious binary paths. Some variants modify security settings including the WDigest registry key (HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest) to facilitate credential theft. Dropped files appear in temporary directories with randomized names, including configuration files named with "_ISMSIDEL.ini" extensions and log files like "0x0409.ini".  

The malware may drop modified InstallShield engine files including "ISSetup.dll" and core payloads named with patterns like "UnionCryptoTrader.msi". Some variants install kernel level components such as "usbdrv3.sys" in the temporary folder for elevated privileges. Additional artifacts include "net_ver.dat" containing lists of compromised IP addresses and staged payloads saved as "lconcaches.db" in the AppData Microsoft Windows folder.