lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
From: jlacour at zonelabs.com (John LaCour)
Subject: Virus / Trojan

It's the Xombe Trojan/Downloader.

> -----Original Message-----
> From: Otero, Hernan (EDS) [mailto:HOtero@...chile.cl] 
> Sent: Friday, January 09, 2004 11:48 AM
> To: full-disclosure@...ts.netsys.com
> Subject: [Full-Disclosure] Virus / Trojan
> 
> 
> Today found this suspicious file attached to an email, 
> obviously is a virus (our AV don?t detect it :-( ). The 
> virus/trojan is very simple, the developer only put effort in 
> obfuscate the strings inside the binary.
> 
> The executable file try to connect to gamemaniacs.org and 
> download a file. This file will be located in the system directory
> 
> The url used in the GET is:
> 
> gamemaniacs.org /download/get.php?dist=2
>  
> This will download the binary saved as msvchost.exe
> 
> any one know what virus/trojan is this?
> 
> 
> 
> -H
> 
> 
>  <<VIRUS1_DETECTED_AND_REMOVED_winxp_sp1_VIRINFO.TXT>> 
> 


Powered by blists - more mailing lists