TrojanDropper:Win32/Nuwar.gen!C

TrojanDropper:Win32/Nuwar.gen!C is a detection for a particular family of trojans that receives commands indirectly from a remote attacker via connection to a malicious peer-to-peer network.

In the wild, it has been observed being spammed out attached to e-mail messages regarding April Fool’s Day. The following filenames have been observed being used as the attachment name in these malware seedings:

 

When executed, the trojan copies itself to the Windows directory as aromis.exe and modifies the registry to run this copy at each Windows start:

 

Adds value: "aromis"
With data: "%windir%\aromis.exe"
To subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Drops Additional Malware/Backdoor Functionality
TrojanDropper:Win32/Nuwar.gen!C drops a file to %windir%\aromis.config. This is a configuration file that contains a list of peers to connect to as well as other information pertaining to the malware's peer-to-peer network. It is detected as Backdoor:Win32/Nuwar.B!ini. It listens on a random UDP port in order to connect to its peer-to-peer network. Once connected to the network, active peers can be instructed to perform several actions, such as downloading or executing arbitrary files.

 

Modifies System Settings
TrojanDropper:Win32/Nuwar.gen!C attempts to bypass the firewall by running the following command:
netsh firewall set allowedprogram "%windir%\aromis.exe" enable

It also modifies the following registry entry:
Adds value: "NtpServer"
With data: "time.windows.com,time.nist.gov"
To subkey: HKLM\System\CurrentControlSet\Services\W32Time\Parameters