W32/Nugache Worm

 Information about the W32/Nugache Worm:

W32/Nugache is an email worm. The worm will infect Windows systems. The worm spreads through email, network shares and Messenger.

The subject of the infected mail will be any one of the following;

hi
lol
hey
hey!
FW:
sup
heh
okay
here
light
k, here
what up
hey there

The body of the infected mail will be any one of the following;

ass
boat
cake
clown
dick
douche
face
fag
hat
head
here
hey
i almost deleted
i found
i promised
k
ok
okay
Shit
that nigger
that shift
that thing
the file
the shit
wad
wagon
you like
you wanted

The infected attachment will be any one of the following;

details
backup
forwarded
documents
attachment

The extension of the infected attachment will be any one of the following;

.scr
.scp.scq.scr

Upon execution of the infected attachment, the worm copies itself as MSTC.EXE in Windows System folder. It also copies itself as FNTCACHE.BIN in the <User Profile's> Application Data folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm mails itself to the gathered addresses using its own SMTP engine.

The worm also has backdoor capabilities that connect to IRC Internet Relay Chat server using TCP port 8. It also provides the backdoor functionalities like;

launch denial of service attack
Run as Web server
download and execute remote file

This worm first appeared on May 01, 2006.

 Other names of W32/Nugache Worm:

This Worm is also known as W32/Nugache@MM, W32.Nugache.A@mm, Backdoor.Win32.Sdbot.aqy .