full-disclosure - New Worm in the wild

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200308191530.RAA16358@fire.malware.de>
From: malware at t-online.de (Michael Mueller)
Subject: New Worm in the wild

Hi dbtrino,

you wrote:
> we see a lot of ping traffic and have a lot of users who report of mails
> with attachements ~74KB which have not been send by the 'sender'.

The ping traffic might be caused by a worm name W32/Nachi by NAI. See
http://vil.nai.com/vil/content/v_100559.htm .
It does use the DCOM RPC hole and a flaw in IIS/5.0 as reported in
http://www.securityfocus.com/bid/7735/info/

The mails match the report of W32/Sobig.f@MM, see
http://vil.nai.com/vil/content/v_100561.htm

Michael