full-disclosure - Backdoor not recognized by Kaspersky

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4045E353.5050808@mpex.net>
From: gpel at mpex.net (Gregor Lawatscheck)
Subject: Backdoor not recognized by Kaspersky

Suresh Ponnusami wrote:

> Another variant against the Netsky virus. It's is packed with
> UPX. It spreads with the password protected zip file, which
> gets bypassed through all most all the AV scanners with
> latest signature updates because No AV can decrypt it
> without the password. (though password is in the message
> content), we humans tend to open it after reading the message.

Kaspersky, NAI and possibly some other AV-vendors now parse the password 
from the body of the email to extract the zip and then scan it. 
Obviously this only helps if it can scan the complete email i.e. on the 
mailserver. They might need to adapt to new varitions of how the 
password is included in the body, which will take some analysis when new 
variants emerge.