Win32/Stuc

Installation

Win32/Stuc changes the following registry entry so that it runs each time you start your PC:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "MicrosoftStCnt"
With data: "<Sample path>\<sample name>.exe", for example, %TEMP%\<sample name>.exe

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "MicrosoftDvCnt"
With data: "<Sample path>\<sample name>..exe" 

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "MicrosoftSfCnt"
With data: "<Sample path>\<sample name>..exe" 
 
It also creates the following registry entries as part of its installation routine:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion
Sets value: "WireGgMode"
With data: "[36bytes binary data]" for example, "49 E3 C0 5C 20 B4 85 02 02 2B F8 93 31 9B 02 71 B1 33 1C 3F 34 F7 C1 5B 85 77 49 EE E2 59 F5 A8 1E 52 E6 A0" 
 
In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "WireLMode"
With data: "[36bytes binary data]"  
 
In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "WireSgMode"
With data: "[36bytes binary data]"  

Payload

Sends spam email messages
 
Win32/Stuc can send spam e-mail messages from your PC using its own SMTP engine. It uses HTTP POST to connect to the IP address 91.194.254.32, or mail.hfwjww10proxiesss.com, on TCP port 443 to download predefined spam messages.

The following is an example of the spam messages we have seen this threat send:

POST /sofctpnmrmg.asp HTTP/1.1
Content-Type: application/x-www-form-urlencoded

Cache-Control: no-cache

User-Agent: Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 6.0; en-US)

Host: mail2.goodfluxetcwow1.com:443

Content-Length: 117

Connection: Close

gqlyaqdr=kG/iGbMs/dkh4xn9rijBHJpQWSqTsQSfDpEIkz7e9+y2QlJSLFxif0JYLCxSPnRpu40dv5D2ttpP+T4HkTs2vL38TFVRinRFiLrqBLlcGCw=

Analysis by Steven Zhou