lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <BAY7-DAV238hwbdlk8V0002c68b@hotmail.com>
From: helmut_hauser at hotmail.com (Helmut Hauser)
Subject: Quick Analysis of Netsky-B

The Viruswriter seems to be from Germany

The string skynet@...net.de
AdmSkynetJklS003
can be found inside the virus code
the IP 217.5.100.1 is a dial up from the german Telekom: DTAG-DIAL13
one of the attatchment names refers to a german explicit "movie star"

Nothing new as I can see, packed with upx, UDP packet sender, SMTP Routine,
tries to install itself as a service, tries to infect network shares and
file sharing ... business as usual.
the only not so harmless function is: Kernel32.DeleteFilaA


Helmut


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ