New Mass Mailer

I keep getting this:

Quote:

---

Hi! I am looking for new friends.

My name is Jane, I am from Miami, FL.

See my homepage <http://somerandomip:1639/index.htm> with my weblog and
last webcam photos!

See you!

---

Is this anything new? The email itself does not seem malicious, but I bet dollars to donuts the IP/page it links to is. If anyone has any of these emails, and can get the source of the page it links to, I'd like to see it. (every one I have tried has timed out.) I'm interested in how it is exploiting people.

Thanks!

edit (there are many variations on this, including attachments w/o executable code)

I haven't gotten a email like that.

I'm about to reformat this box though send me that link and I'll grab the source for you.

Unfortunately I tossed all the emails. They aren't even in the trash, for some reason. :/

None of them had a working link, each one is probably being DDoSed by people trying to do the same thing. I have a feeling they are zombie boxes being linked. Anyway, I'm sure to get another one, expect a pm if you are interested. I just gotta catch it early enough where the link still works :p, then I can telnet to it and grab the source.

It's a new variant of mydoom, which exploits the as-yet unpatched Internet Explorer IFRAME vuln. You can find more info from Symantec:

http://[email protected]

Thanks Timmy77, I was infected partially on a friends system with something similiar to it and I couldn't figure out whether it was new or old and what to do with it.

Happy I could help.

Incidentally, another mydoom just popped up, very similar to this one, just with different subject lines in the e-mail.

http://[email protected]

Hmm, you put it best when you said they were "different variant's of mydoom". That was the best way to put it and I don't think we've seen the last of them personally. I think we'll see several similiar to it just with different subject lines/messages.

On the issue of the new Mydoom AI.....

This is a hard one to stop at the perimeter. It's not an attachment but rather a URL. I'm trying to determine if my firewall can filter URL's in SMTP by content type without screwing the whole pooch. In the meantime this is definitely worth a warning to the users.

I suspected that the URL would contain an IP address rather than an FQDN that would point to an owner and it appears that others on this thread have confirmed my expectation.... it's something the users can understand.

And there we go again with the naming inconsistencies (whoever posted about it not too long ago :) )...

Timmy's first link - Symantec's site: MyDoom.AH
According to the Symantec site, Sophos calls it Bofra-B. (and MyDoom.AI is Bofra-A)...
But McAfee calls the AI variant AG, CA only got to AF, Kaspersky only AD...

And Sophos calls this interesting one (the one with the attachments) AG, while Symantec calls it AF, and Kaspersky AA... jeebus.

Symantec is calling it AI....

Ok, so far I've seen 3 types, one with a link & .eml attachment, link & no attach, and one from a paypal spoofed address w/ link. The paypal one is extremely convincing. The subject line is like, "Payment received!" or whatever. I got really worried and checked my bank balance on the spot before before even thinking it was another mydoom variant... It's a safe bet people are going to click that link inside. I checked my balance before opening the email, but the untrained eye won't be able to tell that paypal wouldn't link you to an IP inside their email.

Tiger- Every email I've seen has linked to the same IP. You can block all access to that IP, prolly not a bad idea.

IP is 10.55.3.245 on varying ports. Also, the emails all seem to have some sort of antivirus label in their source, (X-AntiVirus: Checked for viruses by Gordano's AntiVirus Software) and similar. I've never heard of them, so you could probably filter by them until you have something stronger to key on.

Soda:

10.anything is a private address.... It won't be transmitted across the internet and therefore cannot be the point of infection..... View the source, (html), of the the email and you will probably see an <image map> , my best guess right now..... That's a bummer... because it looks like something it's not too.... it's a phishing trick that appeared relatively recently.....

Please confirm my suspicion.......

No image maps.

Quote:

---

Return-Path: <[email protected]>
Delivered-To: ----------------------
Received: from vhboots.com (drake-200-218.drake.edu [207.28.200.218])
by -------------- (Postfix) with ESMTP id BA59932BC
for <-------------------.edu>; Tue, 9 Nov 2004 08:42:44 -0600 (CST)
Received: from Knap-SKehoe1.drake.edu (Knap-SKehoe1.drake.edu [10.55.3.245])
by drake.edu (8.12.8p1/8.12.8) with ESMTP id i38O9Fim028351
for <------------------------->; Tue, 9 Nov 2004 08:42:44 -0600
(envelope-from [email protected])
Message-Id: <000801c4c638$14f3d990$f503370a@KnapSKehoe1>
X-AntiVirus: Checked for viruses by Gordano's AntiVirus Software
From: [email protected]
To: --------------------------
Subject:
Date: Tue, 9 Nov 2004 08:42:44 -0600
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0005_01C4C638.14F3D990"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1081
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081

This is a multi-part message in MIME format.

------=_NextPart_000_0005_01C4C638.14F3D990
Content-Type: text/html;
charset="iso-8859-2
Content-Transfer-Encoding: quoted-printable

<html>

<body>

Hi! I am looking for new friends. I am from Miami, FL. You can see my <a href=3D"http://10.55.3.245:1639/index.htm">homepage</a> with my last webcam photos!
</body>
</html>

Hello!




------=_NextPart_000_0005_01C4C638.14F3D990--

---

It looks like the e-mail was sent from one client in the drake.edu domain to another (therefore the 10.x IP), and then from that second client to Soda... the message is "built" by using the sender's IP address, but that didn't seem to have worked very well (since in this case the link was built using the IP of two senders back in stead of just one). Since the sender is infected, a web server can be opened on its port 1639, and the receiver of the e-mail should be able to connect to that server through the link in the e-mail - but not in this case...

Hi Soda,

Slightly off the topic but the Gordano's AV Software rang a bell..................they are a British outfit based in Somerset?????????????????

Here is a link to their site:

http://www.gordano.com/kb.htm?q=1621

That is peculiar, and may be genuine as it would be odd to spoof checking by a virtually unknown AV product, which might be calculated to arouse suspicion. I would have expected spoofing the AVG message, or one of the better known products?

just a thought

EDIT: Even curiouser, vhboots.com appears to be a Van Halen bootleg music site?

Just a quick bit of info..

Soda: The IP in the link in the emails is the machine that sent the email since it contains its own smtp engine. If you were to click on it, it would connect back and DL the payload as per instruction.

I understand that,

My main curiosity was how it forced the payload onto the target, but now that I know it is the new IFrame vuln as someone added, I am wondering why all the emails I am getting are going to the same internal address, when I am receiving these emails from different places, outside my network?

irc..let's talk. ;)

Caught the sucker...

Source of the page the emails link to is attached.

Password is antionline.

Don't be stupid, unless you have a test enviroment, don't touch this link.