full-disclosure - Sears Scam Trojan Code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Pine.BSO.4.58.0312272014350.20271@mail.klake.org>
From: jt at klake.org (Jarkko Turkulainen)
Subject: Sears Scam Trojan Code

Took some time to realize, but the proxy is a standard SOCKS V4. What's
interesting, the proxy port is chosen by the system (next port
available) and it's announced every 30 secs to cjdra.com as indicated in
the earlier post. The cjdra.com IP also seem to change very often..
That's all, I guess.

Regards,

--
Jarkko Turkulainen <jt@...ke.org>