Printable View
My gateway is catching a lot of executables attempting to come in via e-mail. The e-mail is coming in with a subject of either "Is sent SMS" or "The picture is sent on SMS". The executable usually has the name of "f5434.exe" or "ds-rwe.exe" .
Now I have searched the usual (Symantec, TrendMicro....etc) but I am coming up blank. Anyone seeing this activity?
Cheers:
I think i receieved it once or twice, but it was marked as spam by gmail so i just deleted it.
DjM can you turn one into a .txt or zip?
I will gladly dissect it for you :D
Sorry Mate, I have a "drop-dead" rule on my gateway. All executables are stripped and sent to that big "bit-bucket" in the sky. To trap one, I have to disable the rule, which is something I am not real crazy about doing. ;)Quote:
Originally posted here by nihil
DjM can you turn one into a .txt or zip?
I will gladly dissect it for you :D
I'll see if I can come up with a way to trap one without throwing the doors wide open.
Cheers:
Hey Hey,
Here's a copy of the file.
It came in to our work email (2 copies to our one helpdesk account over the weekend, and one to our other account...)
The original zip file is in the folder... and the folder is compressed into a new zip file with the password antionline.com
Maybe I'll throw it into a VM tonight and see what it does...
Peace,
HT
Nope
Not getting any here.......Yet!
:(
Just checked what was filtered too....nothing similar
MLF
I am seeing that zip file too HT, along with Beach.zip and In_park.zip.Quote:
Originally posted here by HTRegz
Hey Hey,
Here's a copy of the file.
It came in to our work email (2 copies to our one helpdesk account over the weekend, and one to our other account...)
The original zip file is in the folder... and the folder is compressed into a new zip file with the password antionline.com
Maybe I'll throw it into a VM tonight and see what it does...
Peace,
HT
Can you find any info. on the Virus sites about this?
Cheers:
http://isc.sans.org/
http://isc.sans.org/diary.php?date=2005-06-26
Quote:
We're receiving early reports of a new Bagle variant making the rounds. At the time of writing, many Antivirus products are not detecting this most recent mutation of the mass mailer. Identifying characteristics include a reference to SMS in the subject line, and ZIP attachments with various names containing an EXE named f22-013.exe with an md5 checksum of 3f123980866092fedd6bc75e9b273087. Our thanks go out to the numerous ISC readers who alerted us to this.
When scanned with Symantec Corp, it comes up as this...
http://securityresponse.symantec.com...n.tooso.j.html
SNIP
Trojan.Tooso.J is a Trojan horse that interferes with the operation of security software by terminating processes, stopping services, removing registry entries, and deleting files.
I figured that was the bugger too horse, but the Symantec wirte-up didn't have very much detail (subject line, attachment name...etc) :rolleyes:Quote:
Originally posted here by thehorse13
When scanned with Symantec Corp, it comes up as this...
http://securityresponse.symantec.com...n.tooso.j.html
SNIP
Trojan.Tooso.J is a Trojan horse that interferes with the operation of security software by terminating processes, stopping services, removing registry entries, and deleting files.
Cheers:
Hey Hey,
This thing definately reads a lot of directories and a lot of files... it also does some file creation and that's what I documented.
Extract zip file
single exe - f22-012.exe
Run the EXE
system32\winshost.exe is created
ntuser.dat and ntuser.dat.log in c:\documents and settings\Administrator were changed
HKLM\Software\Microsoft\Windows\CurrentUser\Run\winshost.exe added
system32\config\software.log modified
system32\wiwshost.exe created
At this point explorer crashed and drwatson ran... The logs became so full that I couldn't follow it anymore.
I had my subnet changed (in case it did any scanning/passing by looking at the current subnet range).. but I didn't see any network traffic..
Peace,
HT
Glad to see I'm not the only one with a no tolerance rule.... Works perfectly doesn't it? :DQuote:
Sorry Mate, I have a "drop-dead" rule on my gateway. All executables are stripped and sent to that big "bit-bucket" in the sky.
Hey Hey,Quote:
Originally posted here by Tiger Shark
Glad to see I'm not the only one with a no tolerance rule.... Works perfectly doesn't it? :D
I can't understand why all companies don't have this in place... I really don't know why we don't have it.... Is there a company out there without this in place that can explain why you don't have it and your reasoning?
Peace,
HT
Please.....
Tiger isn't the only evil mean monster out there. I have about 35 file extensions that aren't allowed.
:)
Hey TH13,Quote:
Originally posted here by thehorse13
Please.....
Tiger isn't the only evil mean monster out there. I have about 35 file extensions that aren't allowed.
:)
Try and figure this one out.. we block access files (.mdb) but the virus infected exe in a zip file passes easily into our mailboxes.... How's that for a good corporate policy.
Peace
HT
It does work perfectly, I have pissed a few people off but hey, thats what they pay me for. :pQuote:
Originally posted here by Tiger Shark
Glad to see I'm not the only one with a no tolerance rule.... Works perfectly doesn't it? :D
Cheers:
Ah.. It's the new Bagle variant.. Why didn't I notice this thread before :confused:
http://www.antionline.com/showthread...r=1#post846896
I just wanted to thank you all for the early heads up on this. I was able to get a quick update and was prepared when the sucker started showing up in my area. Got 31 of the little buggers caught in quarrantine today. Way Cool!
While scanning HTRegz's attachment on http://virusscan.jotti.org , it found the Bagle worm
OLD THREAD: Sirdice commented 2 post and a month before of what the bug was.... Take close attention of the dates and READ THE WHOLE THREAD..
Oh sorry forgot: First post.. Wellcome to Antionline.. Please be sure to visit and READ the site FAQ.. and any Threads that may be "Sticky" that relate to posting on these here boards.. many of us are house trained.. some do bite.. so please becareful.. so to be safe please dont feed the animals..Quote:
Ah.. It's the new Bagle variant.. Why didn't I notice this thread before
http://www.antionline.com/showthrea...er=1#post846896
Thank you .. have a pleasent time here.. as we trust that we may enjoy your many future contributions..
Cheers