bugtraq - Israeli industrial espionage Trojan horse sample + snort sigs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <42A10A5E.1030902@linuxbox.org>
Date: Sat, 04 Jun 2005 05:56:46 +0400
From: Gadi Evron <ge@...uxbox.org>
To: bugtraq@...urityfocus.com
Subject: Israeli industrial espionage Trojan horse sample + snort sigs


Well, it's been few days since this story broke and amazingly only a few
AV companies detect it.

I am distributing it to the rest of the vendors with the help of a
friend, so at least that's covered, however, due to the nature of this
incident and the high interest I believe many others in the security
industry may want it and I am too busy to answer everyone pinging me.

Please email me privately and I'll share it securely with those of you
who have a reason to have it.

I hope to get more versions of the sample soon here in IL, as any
variant I get is the same one from the same incident.

Matt Jonkman over at Bleeding-Snort wrote and released snort signatures,
in cooperation with Joe Stewart at lurhq and myself at IL-CERT.
I am sure many organizations would be interested in those.

http://www.bleedingsnort.com/cgi-bin/viewcvs.cgi/Stable/VIRUS/TROJAN_Hotword?rev=1.1&view=auto

alert tcp $EXTERNAL_NET any -> $HOME_NET 2any(msg:"BLEEDING-EDGE VIRUS
Hotword Trojan in Transit"; content:"|63 6f 6d 66 69 64 65 6e 74 69 61
6c 20 64 6f 63 75 6d 65 6e 74 20 28 57 6f 72 64 29 20 66 72 6f 6d 20 44
69 67 69 44 6f 63 00 43 4d 20 25 73 20|"; flow:established,from_server;
classtype:trojan-activity;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.hotword.html;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.rona.html;
sid:2001959; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"BLEEDING-EDGE
VIRUS Hotword Trojan inbound via http"; content:"|63 6f 6d 66 69 64 65
6e 74 69 61 6c 20 64 6f 63 75 6d 65 6e 74 20 28 57 6f 72 64 29 20 66 72
6f 6d 20 44 69 67 69 44 6f 63 00 43 4d 20 25 73 20|";
flow:established,from_server; classtype:trojan-activity;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.hotword.html;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.rona.html;
sid:2001960; rev:1;)
alert tcp any any -> $EXTERNAL_NET 21 (msg:"BLEEDING-EDGE VIRUS Hotword
Trojan -- Possible File Upload CHJO"; content:"STOR __";
content:"-CHJO.DRV"; within:100; nocase; classtype:trojan-activity;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.hotword.html;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.rona.html;
sid:2001961; rev:1;)
alert tcp any any -> $EXTERNAL_NET 21 (msg:"BLEEDING-EDGE VIRUS Hotword
Trojan -- Possible File Upload CFXP"; content:"STOR __";
content:"-CFXP.DRV"; within:100; nocase; classtype:trojan-activity;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.hotword.html;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.rona.html;
sid:2001962; rev:1;)
alert tcp any any -> $EXTERNAL_NET 21 (msg:"BLEEDING-EDGE VIRUS Hotword
Trojan -- Possible FTP File Request pspv.exe"; content:"SIZE pspv.exe";
classtype:trojan-activity;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.hotword.html;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.rona.html;
sid:2001963; rev:1;)
alert tcp any any -> $EXTERNAL_NET 21 (msg:"BLEEDING-EDGE VIRUS Hotword
Trojan -- Possible FTP File Request .tea"; content:"LIST ";
content:".tea"; nnocase; within:50; classtype:trojan-activity;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.hotword.html;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.rona.html;
sid:2001964; rev:1;)
alert tcp any any -> $EXTERNAL_NET 21 (msg:"BLEEDING-EDGE VIRUS Hotword
Trojan -- Possible FTP File Status Upload ___"; content:"|53 54 4f 52 20
5f 5f 5f 0d 0a|"; classtype:trojan-activity;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.hotword.html;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.rona.html;
sid:2001965; rev:1;)
alert tcp any any -> $EXTERNAL_NET 21 (msg:"BLEEDING-EDGE VIRUS Hotword
Trojan -- Possible FTP File Status Check ___"; content:"|53 49 5a 45 20
5f 5f 5f 0d 0a|"; classtype:trojan-activity;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.hotword.html;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.rona.html;
sid:2001966; rev:1;)


	Gadi Evron.