Anti Spyware Trojan?
As reported by ISC Handler Pat Nolan, a new trojan has been released into the wild that seems to terminate processes and delete files and registry keys known to be associated with adware products. More details are available at http://securityresponse.symantec.com/avcenter/venc/data/downloader.lunii.html
We've received reports of a few new botnet infestations of the same critter Deb Hale reported in http://isc.sans.org/diary.php?date=2004-09-25 . Botnets are a perfect example of why you need to know what's normal on your network and what's not. Great job Dan and Mr. Anonymous Senior Analyst. ;)
Speaking of botnets ...
The ISC was alerted to a .jpg image file (thanks Mark!) that had an MS04-028 overflow which caused the machine to download and run an executable, jpeg.exe
jpeg.exe silently installs a service on the PC as well as a registry key to autorun at reboot, then goes out to an IRC site, notifies of the compromise and waits for commands.
Actions have been taken to have the offending site blocked.
AV scan results of jpeg.exe are as follows (from http://www.virustotal.com ):
Antivirus Version Update Result
BitDefender 7.0 10.05.2004 Backdoor.Hackarmy.1.Gen
ClamWin devel-20040922 10.05.2004 -
eTrust-Iris 184.108.40.206 10.04.2004 Backdoor/AZV.Variant
F-Prot 3.15a 10.05.2004 W32/Hackarmy.AJ@bd
Kaspersky 220.127.116.11 10.05.2004 Backdoor.Hackarmy.gen
McAfee 4396 09.29.2004 BackDoor-AZV.gen
NOD32v2 1.884 10.04.2004 probably unknown NewHeur_PE
Norman 5.70.10 09.30.2004 W32/Backdoor
Panda 7.02.00 10.04.2004 Bck/HackArmy.T
Sybari 7.5.1314 10.05.2004 Backdoor.Hackarmy.gen
Symantec 8.0 10.04.2004 -
TrendMicro 7.000 10.04.2004 -
Bellhops and luggage carts and sheets, oh my!
While SANS NS Las Vegas 2004 will remain firmly engraved in many people's memory, it hopefully won't be remembered for the record attempt mentioned previously, that eventually failed. We're happy to report that there were no serious injuries and that all handlers have (apparently) survived unharmed. It should be noted however that the handler attempting the record has not been heard from since just after the attempt when he was seen with several statuesque showgirls. Good luck Tom, wherever you are. ;)
Handler on Duty
Oct 6th 2004
Oct 6th 2004
1 decade ago