Gadi Evron
27/10/03, 19:45
I usually do not email about "new" trojan horses unless they have
something "special" about them, for there are a lot of them coming out
non-stop. However, with this one,
Although quite simple, is very destructive and spreading at incredible
speed.
The trojan horse spreads by people going to different URL's to download
a *.jpg (started with britney.jpg).
The jpeg is actually an HTML file, and when the web browser receives it,
it thinks that it is a server error message for the file not existing,
and loads the page.
In the page we find a javascript line, that using hex encoding in an
attempt to hide what it does, downloads patch.exe and replaces
mplayer.exe with the new file.
patch.exe connects to the mIRC DDE server, causing mIRC to spam, and
then it start ruining the system's registry. Starting to delete keys at
root and enumerating from there, one at a time.
What I signify, and forgive my language, as an "Hump and dump" trojan
horse.
This reminds me of the first patch.exe trojan horse, that was purely a
destructive file - back in 95/96.
I would also like to commend angelfire for shutting down the first web
page this appeared on very quickly. They always respond to abuse in a
timely manner. The geocities page is still up last time I checked.
Not very complicated, but interesting, and very dangerous.
Gadi Evron (i.e. ge),
ge@linuxbox.org.
--------
gevron@netvision.net.il
PGP Key: 2048/2048 (Size) 0x2D3D6741 (ID).
Fingerprint: 0EB3 00BC 974B 3C2B 336D 6486 ECA5 2D0D 2D3D 6741.
something "special" about them, for there are a lot of them coming out
non-stop. However, with this one,
Although quite simple, is very destructive and spreading at incredible
speed.
The trojan horse spreads by people going to different URL's to download
a *.jpg (started with britney.jpg).
The jpeg is actually an HTML file, and when the web browser receives it,
it thinks that it is a server error message for the file not existing,
and loads the page.
In the page we find a javascript line, that using hex encoding in an
attempt to hide what it does, downloads patch.exe and replaces
mplayer.exe with the new file.
patch.exe connects to the mIRC DDE server, causing mIRC to spam, and
then it start ruining the system's registry. Starting to delete keys at
root and enumerating from there, one at a time.
What I signify, and forgive my language, as an "Hump and dump" trojan
horse.
This reminds me of the first patch.exe trojan horse, that was purely a
destructive file - back in 95/96.
I would also like to commend angelfire for shutting down the first web
page this appeared on very quickly. They always respond to abuse in a
timely manner. The geocities page is still up last time I checked.
Not very complicated, but interesting, and very dangerous.
Gadi Evron (i.e. ge),
ge@linuxbox.org.
--------
gevron@netvision.net.il
PGP Key: 2048/2048 (Size) 0x2D3D6741 (ID).
Fingerprint: 0EB3 00BC 974B 3C2B 336D 6486 ECA5 2D0D 2D3D 6741.