Spammer:Win32/Nuwar

Spammer:Win32/Nuwar is a component of the Win32/Nuwar Trojan family, and is used to relay e-mails. E-mail messages are sent in various formats, commonly containing a hyperlink to a remote Web site hosting Win32/Nuwar Trojan files.

 

Spammer:Win32/Nuwar is commonly installed in one of these locations:
%WinDir%\spooldr.exe
<system folder>\taskdir.exe

 

Additional components of Spammer:Win32/Nuwar may exist as any of these files:
<system folder>\adir.dll
<system folder>\taskdir.dll
<system folder>\zlbw.dll (Clean file used for decompression)

 

Upon installation, Spammer:Win32/Nuwar contacts remote Web sites to receive compressed e-mail configuration information, which includes email body content and recipients. The information is then decompressed, interpreted and the infected machine becomes a spam relay.

 

Later variants drop a kernel-mode driver <system folder>\spooldr.sys, which is used to protect the spammer component from removal and to disable common firewalls.

 

The kernel-mode driver attempts to prevent any executable image with the following substrings from executing:
<system folder>\vsdatant.sys
<system folder>\drivers\bcfilter.sys
<system folder>\drivers\bcftdi.sys
<system folder>\drivers\bc_hassh_f.sys
<system folder>\drivers\bc_ip_f.sys
<system folder>\drivers\bc_ngn.sys
<system folder>\drivers\bc_pat_f.sys
<system folder>\drivers\bc_prt_f.sys
<system folder>\drivers\bc_tdi_f.sys
%ProgramFiles%\zone labs\zonealarm\zclient.exe
%ProgramFiles%\agnitum\outpost firewall\kernel\filtnt.sys
%ProgramFiles%\agnitum\outpost firewall\kernel\sandbox.sys
%ProgramFiles%\mcafee.com\personal firewall\data\drv\mpfirewall.sys

 

The kernel-mode driver terminates the following processes:
zlclient.exe
outpost.exe

 

The kernel-mode driver hides files and folders beginning with "spooldr" by hooking the ZwQueryDirectoryFile API, as well as denying access to tcpip.sys, by hooking ZwCreateFile.

 

Related Malware

• Spammer:Win32/Nuwar.A!dll

• Spammer:Win32/Nuwar.A!sys

• Spammer:Win32/Nuwar.B

• Spammer:Win32/Nuwar.C

• Spammer:Win32/Nuwar.D

• Spammer:Win32/Nuwar.E

• Spammer:Win32/Nuwar.gen!A

• Spammer:Win32/Nuwar.gen!B