Win32/NukeSped [Threat Name] go to Threat

Win32/NukeSped.AA [Threat Variant Name]

Category trojan
Size 169472 B
Detection created Oct 25, 2017
Detection database version 16303
Aliases Trojan.Win32.Cossta.akbq (Kaspersky)
Short description

The trojan serves as a backdoor. It can be controlled remotely.

Installation

The trojan does not create any copies of itself.

Information stealing

The trojan collects the following information:

  • unique identifier of infected computer
  • computer IP address
  • computer name
  • user name
  • locale
  • operating system version
  • CPU information
  • amount of operating memory

The trojan attempts to send gathered information to a remote machine.

Other information

The trojan acquires data and commands from a remote computer or the Internet.


The trojan contains a list of (3) IP addresses. The TCP protocol is used in the communication.


The network communication with remote computer/server is encrypted. The RC4 encryption algorithm is used.


It can execute the following operations:

  • download files from a remote computer and/or the Internet
  • run executable files
  • send the list of disk devices and their type to a remote computer
  • send the list of files on a specific drive to a remote computer
  • upload files to a remote computer
  • copy files
  • delete files
  • send the list of running processes to a remote computer
  • terminate running processes
  • connect to remote computers to a specific port
  • stop itself for a certain time period

Please enable Javascript to ensure correct displaying of this content and refresh this page.