CANADA.EXE Findings

From: John H (surfcityjohn@yahoo.com)
Date: 03/13/03

  • Next message: Andy Polyakov: "Re: [unisog] Port 109 Mystery" 
    Date: Wed, 12 Mar 2003 20:56:08 -0800 (PST)
From: John H <surfcityjohn@yahoo.com>
To: incidents@securityfocus.com

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    All:

    CANADA.EXE (aka HOT CANADA) is a "dialer" by nature. In fact, a
    known dialer:
    http://www.pestpatrol.com/PestInfo/db/h/hot_canada.asp.

    The loose sequence of events upon execution is as follows:

    After CANADA.EXE is executed, it pops up a dialog that displays a
    pornographic image and asks the user if they would like to go to a
    porn site.

    Meanwhile, behind the scenes...

    It downloads HOT_CANADA.EXE from either 208.192.120.56 and
    204.177.92.205 (via HTTP/port 80). HOT_CANADA.EXE is placed in a
    very obvious "dialers" folder under Program Files.

    HOT_CANADA.EXE then begins execution.

    It contacts 204.177.92.204 (via HTTP/port 80) and proceeds to
    download HOT_CANADAUPDATE.EXE which is placed in the root directory
    of the PC.

    HOT_CANADAUPDATE.EXE then takes over with the most interesting
    activity and downloads HotOrgy_ca.exe and HardcoreVideos_ca.exe.
    They are placed in their own directories under the now infamous
    "dialers" directory. Links are placed on the desktop and start menu
    to these new files.

    HOT_CANADA.EXE at this point seems to go into an idle state and this
    is where my experiments stopped. The outbound traffic was minimal
    and consisted of HTTP requests. HOT_CANADA.EXE did examine the
    registry entries for RAS, long distance dialing codes, and analog
    modem devices.

    This looks like a genuine "dialer" program. Although CANADA.EXE
    appeared to be "compacted" with PECompact, there appeared to be no
    serious effort to hide or obfuscate what this program and its
    supporting executables do. My window of testing was very short, so
    there may be more unsolicited action later on down the execution
    path. Naturally, it should not be assumed this program or programs
    like it are harmless based on what I have said. The should be
    considered a real threat, because this program had full access to my
    machine and the data contained within while it was executing.

    By the way, the IPs belong to a company called Lexitrans.

    Regards,

    John Herndon
    Security Consultant

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.1 (MingW32) - WinPT 0.7.94

    iD8DBQE+cA1vPAH04z2c9bARArqrAJ4sTIarily9j6SH/s+NNboDgqOSkwCfZZYJ
    lOj/jIuIwYEZXrSeSPn9EIY=
    =pitm
    -----END PGP SIGNATURE-----

    ----------------------------------------------------------------------------

    <Pre>Lose another weekend managing your IDS?
    Take back your personal time.
    15-day free trial of StillSecure Border Guard.</Pre>
    <A href="http://www.securityfocus.com/stillsecure"> http://www.securityfocus.com/stillsecure </A>

  • Next message: Andy Polyakov: "Re: [unisog] Port 109 Mystery"

    Relevant Pages

    • Re: How does VFP locate class libraries during runtime?
      ... >> Visual FoxPro searches for the class or OLE object in the following ... Classes in procedure files opened with SET PROCEDURE ... Program files in the execution chain. ...
      (microsoft.public.fox.helpwanted)
    • Re: How does VFP locate class libraries during runtime?
      ... > When you issue the DO command with a procedure name, Visual FoxPro ... The file containing the DO command. ... Program files in the execution chain. ...
      (microsoft.public.fox.helpwanted)
    • Question for Mark Kleinhaut about emusic
      ... I downloaded your album "Chasing Tales" from emusic - really beautiful, fresh sounding stuff. ... It's all there - tone, ideas, execution. ... I joined emusic back when it first started up, partly because it was one of the few legal services and claimed to compensate artists for internet downloads. ...
      (rec.music.makers.guitar.jazz)