Reply to thread

Message

<blockquote data-quote="SkeletalDemise" data-source="post: 1055564" data-attributes="member: 103400">I&#039;m confident it&#039;s not clean. It connects to various newly registered domains; I&#039;ve seen different samples connect to different domains. Please note that Bitdefender called the zip folder clean, not the installer. The zip folder is harder to analyze as the payload only runs if you run [ICODE]NvStTest.exe 4a4hJ[/ICODE] which the installer does automatically. If you run it in a VM, you can see the NvStTest.exe process taking up all your CPU and RAM.I&#039;ve tested both the real Nulloy installer and the real NvStTest.exe from NVIDIA. Neither of them connects to any sketchy domains or runs in the background. This malware is tricky; the installer is signed, and it downloads a real copy of Nulloy except with additional files. You can compare the folder with a real copy from Nulloy. Everything in [ICODE]Nulloy\Plugins\platforms[/ICODE] besides qwindows.dll is from the malware.</blockquote>

[QUOTE="SkeletalDemise, post: 1055564, member: 103400"] I'm confident it's not clean. It connects to various newly registered domains; I've seen different samples connect to different domains. Please note that Bitdefender called the zip folder clean, not the installer. The zip folder is harder to analyze as the payload only runs if you run [ICODE]NvStTest.exe 4a4hJ[/ICODE] which the installer does automatically. If you run it in a VM, you can see the NvStTest.exe process taking up all your CPU and RAM. I've tested both the real Nulloy installer and the real NvStTest.exe from NVIDIA. Neither of them connects to any sketchy domains or runs in the background. This malware is tricky; the installer is signed, and it downloads a real copy of Nulloy except with additional files. You can compare the folder with a real copy from Nulloy. Everything in [ICODE]Nulloy\Plugins\platforms[/ICODE] besides qwindows.dll is from the malware. [/QUOTE]

Verification