Re: Trojan with outbound notification and no payload

From: Matthew Leeds (mleeds@theleeds.net)
Date: 08/17/01


Message-ID: <200108171213120671.4C6089E0@cracker.globix-sc.cddb.com>
Date: Fri, 17 Aug 2001 12:13:12 -0700
From: "Matthew Leeds" <mleeds@theleeds.net>
To: "'PEN-TEST@SECURITYFOCUS.COM'" <PEN-TEST@SECURITYFOCUS.COM>, "Justin Funke" <Jfunke@kortexcomputer.com>
Subject: Re: Trojan with outbound notification and no payload

You might try a wrapper or binder program like Saran Wrap, Silk Rope, or The Joiner. These are used mostly to deposit Trojan Horses, and consequently might be detected by anti-virus programs, but they may be worth a try. You'll need to hunt to find copies as they mostly exist on black-hat sites.

---Matthew

*********** REPLY SEPARATOR ***********

On 8/17/2001 at 10:27 AM Justin Funke wrote:

>Does anyone know of a script that when executed from an email can notify
>back to me that the attachment was executed. I don't want anything with any
>kind of payload - just a notification as part of a test.
>
>Something not detectable by virus scanners would be a bonus - I want to
>audit the human component of the equation.
>
>Thanks,
>
>Justin.
>
>
>
>
>----------------------------------------------------------------------------
>This list is provided by the SecurityFocus Security Intelligence Alert
>(SIA)
>Service. For more information on SecurityFocus' SIA service which
>automatically alerts you to the latest security vulnerabilities please see:
>https://alerts.securityfocus.com/

----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/



Relevant Pages

  • Re: ettercap help
    ... Anyways have never tried Ettercap for VNC. ... > This list is provided by the SecurityFocus Security Intelligence Alert ... For more information on SecurityFocus' SIA service which ... This list is provided by the SecurityFocus Security Intelligence Alert ...
    (Pen-Test)
  • RE: CFM SQL injection
    ... You should better use union or alike get unauthorized data from the ... This list is provided by the SecurityFocus Security Intelligence Alert ... For more information on SecurityFocus' SIA service which ...
    (Pen-Test)
  • Re: ettercap help
    ... > I can get it to sniff telnet, ftp, pop, smb, but no vnc. ... > This list is provided by the SecurityFocus Security Intelligence Alert ... For more information on SecurityFocus' SIA service which ...
    (Pen-Test)
  • Re: Wardialing
    ... >>> achieving the connection with the modem. ... >>This list is provided by the SecurityFocus Security Intelligence Alert ... For more information on SecurityFocus' SIA service which ...
    (Pen-Test)
  • RE: How to Tackle the Legal Tangle?
    ... How to Tackle the Legal Tangle? ... >This list is provided by the SecurityFocus Security Intelligence Alert ... For more information on SecurityFocus' SIA service which ...
    (Pen-Test)