Win32/NukeSped

Installation

This threat creates three copies of itself in the folder the malware first runs, using file names similar to:

• comon32.exe
• diskpartmg16.exe
• diskpartmg16.exe
• dpnsvr16.exe
• expandmn32.exe
• hwrcompsvc64.exe
• mobsynclm64.exe
• rdpshellex32.exe
• recdiscm32.exe
• taskchg16.exe
• taskhosts64.exe
• taskhost<two randomly-generated ASCII letters>.exe

It checks which version of Windows is running on your PC and then installs either a 32-bit or 64-bit third-party driver to:

• %TEMP% \usbdrv3.sys

These components can be used by Trojan:Win32/NukeSped.B!dha to modify your PC master boot record.

Payload

Installs other malware

The malware also registers itself as a service, and then starts the service. We have seen it add a service with the following details:

This threat drops and runs the following files:

• <malware folder> \igfxtrayex.exe - detected as Trojan:Win32/NukeSped.B!dha
• <malware folder>\net_ver.dat - this file contains a hardcoded list of compromised IPs that the threat tries to connect to

Trojan:Win32/NukeSped.B!dha  also registers itself as a service, and then starts the service. We have seen it add a service with the following details:

Service name:  brmgmtsvc
Display name: Backup and Restore Management Service
ImagePath : <Malware path>igfxtrayex.exe -k

Stops services

This threat stops the following services from running:

• MSExchangeIS
• termservice

Shows you an alert message

This threat also installs the following file:

• %windir% \iissvr.exe

This file is detected as Trojan:Win32/NukeSped.C!dha that binds on port 80.

It disables the following services:

• MSDEPSVC
• SSIS
• SSRS
• W3SVC
• WMServer

Trojan:Win32/NukeSped.C!dha  also contains files that display an HTML message to notifies you that your personal data has been compromised, as shown below:

Connects to a remote host

Additional information

• Reuters: FBI warns of 'destructive' malware

Analysis by Marianne Mallen