full-disclosure - SV: New malware to infect IIS and from there jump to clients

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <BAEFKJBBCIPAKCGNHICFIEOKCMAA.kruse@krusesecurity.dk>
From: kruse at krusesecurity.dk (Peter Kruse)
Subject: SV: New malware to infect IIS and from there jump to clients

Hi Nick,

>It does this via the now very old ms-its: protocol zone-handling bug...
>Apparently someone needs to decode a few more levels of JavaScript, etc
>to work this all out...

I don?t think so. This looks a lot like the unpatched IE bug that was also
exploited by the Ilookup trojan. See http://62.131.86.111/analysis.htm.

>> Consider to deny access to http://217.107.218.147 in your firewall. This
>> will at least prevent client PCs from getting infected.
>
>Thanks Peter, but what about all the _other_ servers out there also
>hosting more or less exactly the same files?  Are you going to provide
>a list of all those IPs too?

Why should I? I think you should look at the code again, Nick.

When the javascript runs it will try to redirect you to a remote server
http://217.107.218.147. This is where the MSITS.EXE and the javascripts are
stored. As far as I know they do not reside on the compromised IIS servers,
but simply pulls of the the payload from the remote host. Meanwhile the host
is no longer available.

Regards
Peter Kruse