full-disclosure - MyDoom.f binary string

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <403BC76A.4090800@yahoo.com>
From: fulldisclosure99 at yahoo.com (Jason Brewer)
Subject: MyDoom.f binary string

I was able to get my hands on two copies of the virus.. They are slightly different 
in size and definitely have different md5sums.

I created a couple of signatures using this string that matched in both files:
25 E5 6C D1 3C 2B 44 53 A8 34 B0 C1 14 3F E4 37

I'm monitoring ports 25, 135:139, 445, and 3127 with this signature to try and catch 
all methods of propagation.

> 
> ----- Original Message ----- 
> 
> From: "Jason Brewer" <fulldisclosure99@...oo.com>
> 
> To: "Full Disclosure" <full-disclosure@...ts.netsys.com>
> 
> Sent: Tuesday, February 24, 2004 4:43 PM
> 
> Subject: [Full-Disclosure] MyDoom.f binary string
> 
> 
> 
> 
> 
> 
>>Does anyone have a binary string for MyDoom.f?
> 
> 
> 
>>I wish to create a "network drive" signature ASAP.
> 
> 
> 
>>Thanks!
> 
> 
>>Jason Brewer