[Full-Disclosure] Backdoor not recognized by Kaspersky

From: Kristian Hermansen (khermansen_at_ht-technology.com)
Date: 03/02/04

  • Next message: please_reply_to_security_at_sco.com: "[Full-Disclosure] OpenLinux: rsync heap based overflow" 
    To: <full-disclosure@lists.netsys.com>
Date: Tue, 2 Mar 2004 17:34:15 -0500

    Attached backdoor not recognized by Kaspersky or Norton 2004? I received
    this file recently, but Kaspersky did not detect malicious code. Wondering
    if any of you guys know about it or have analyzed it before? It is
    definitely NOT a text document. I opened it up with WinHex and see the file
    "yfivyjmg.exe" in there towards the beginning. Looks to be a packed exe
    within, and first few bytes are:

    504B03040A0001000000C07E62309FE242510C300000003000000C00000079666976796A6D67
    2E6578653A47705E116B1456E7F572AF21A99C0D52671B62085EC94DD8FDABE712E68000E55E
    E8A39241

    Last few bytes are:

    E19F9DC6E1E9F0FAA7CD925D18C9104DCA9DF88955F8AEBD81D036BCB930889EAE0D2BA2A6EF
    88A334F8B3108A414B1C9D15AA883225504B010214000A0001000000C07E62309FE242510C30
    0000003000000C000000000000000100200000000000000079666976796A6D672E657865504B
    050600000000010001003A000000363000000000

    I am reluctant to open the zip right now, as I fear it may be exploiting an
    overflow to run the EXE file within. I may try to open it on a virtual
    machine later, but if you guys do know anything about this one please let me
    know. It's nice and small too (12 KB)! Wonder if the guy wrote it himself.
    Of course, the IP address is spoofed to a University of Chicago machine. Is
    it even possible to trace back? I still have the full headers, but they
    looked nicely stripped to the gills. I have been receiving elevated attacks
    via email over the last few days, so maybe it is some guy on this list
    trying to get me ;-) One previous email stated that it was the FBI and to
    call a number listed in the email. This was most likely an attempt to get
    the number I was calling from. This guy thinks he's smooth...

    Kristian Hermansen
    khermansen@ht-technology.com

    -----Original Message-----
    From: management@zerotoys.com [mailto:management@{blankedout}.com]
    Sent: Tuesday, March 02, 2004 5:03 PM
    To: webmaster@{blankedout}.com
    Subject: E-mail account security warning.

    Dear user of {blankedout}.com gateway e-mail server,

    Your e-mail account has been temporary disabled because of unauthorized
    access.

    For details see the attached file.

    For security purposes the attached file is password protected. Password
    is "65316".

    Best wishes,
        The {blankedout}.com team http://www.
    {blankedout}..com

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: please_reply_to_security_at_sco.com: "[Full-Disclosure] OpenLinux: rsync heap based overflow"

    Relevant Pages

    • RE: [Full-Disclosure] Backdoor not recognized by Kaspersky
      ... VirusScreen ASaP detected virus in attachment sent to you by "Kristian ... Backdoor not recognized by Kaspersky ... Subject: E-mail account security warning. ... Your e-mail account has been temporary disabled because of unauthorized ...
      (Full-Disclosure)
    • RE: [Full-Disclosure] Backdoor not recognized by Kaspersky
      ... Backdoor not recognized by Kaspersky ... been receiving elevated attacks via email over the last few days, ... Your e-mail account has been temporary disabled because of unauthorized ...
      (Full-Disclosure)
    • Can send email using 2002 Outlook
      ... Settings" in the e-mail account setup, ... your login with Secure Password Authentication. ... "Task 'SBC Yahoo!mail-gg1212-Sending and Receiving" ...
      (microsoft.public.outlook.general)
    • Re: Cindys request
      ... I bet you continue receiving e- ... but your e-mail account keeps alive. ... family members know the password to get on-line and take over the on- ... then the bank will circulate it forever... ...
      (sci.lang.japan)
    • Re: [Full-Disclosure] Backdoor not recognized by Kaspersky
      ... [Full-Disclosure] Backdoor not recognized by Kaspersky ... I have been receiving elevated attacks ...
      (Full-Disclosure)