newPicture3a.zip / Trojan.Win32.Agent.ttu

[Malekal_morte]

Se propage par le fichier contenant le fichier newPicture3a.zip (se trouve dans %windir%) contenant le fichier newpicture003a.JPEG-www.facebook.com

Message de propagation :

would you mind if I share this picture with a few friends?
I just edited you into this picture, does it look good?
This just looks outrageous, it can't be real right?
Can I post this picture of you on my latest blog entry?
Is it ok if I upload this to my new photo album?
Should I set this as my default picture? Or would I get banned?
Do you care if I post this picture on my profile?
You look a little funky, but I think it's a really nice pic.
There is NO way this pic is too sexy for myspace right?

L'infection ajoute la ligne suivante sur HijackThis :

O4 - HKLM\..\Run: [Windows Host Booter] hostbooter.exe

Fichier Sp7ua.exe reçu le 2008.07.09 13:47:00 (CET)
Situation actuelle: terminé
Résultat: 3/33 (9.09%)
Formaté Formaté
Impression des résultats Impression des résultats
Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.7.9.2 2008.07.09 -
AntiVir 7.8.0.64 2008.07.09 -
Authentium 5.1.0.4 2008.07.08 -
Avast 4.8.1195.0 2008.07.08 -
AVG 7.5.0.516 2008.07.09 -
BitDefender 7.2 2008.07.09 -
CAT-QuickHeal 9.50 2008.07.08 -
ClamAV 0.93.1 2008.07.09 -
DrWeb 4.44.0.09170 2008.07.09 -
eSafe 7.0.17.0 2008.07.08 -
eTrust-Vet 31.6.5940 2008.07.09 -
Ewido 4.0 2008.07.09 -
F-Prot 4.4.4.56 2008.07.08 -
F-Secure 7.60.13501.0 2008.07.08 -
Fortinet 3.14.0.0 2008.07.09 -
GData 2.0.7306.1023 2008.07.09 -
Ikarus T3.1.1.26.0 2008.07.09 VirTool.Win32.DelfInject.AF
Kaspersky 7.0.0.125 2008.07.09 -
McAfee 5334 2008.07.08 -
Microsoft 1.3704 2008.07.09 VirTool:Win32/DelfInject.gen!AF
NOD32v2 3254 2008.07.09 -
Norman 5.80.02 2008.07.08 -
Panda 9.0.0.4 2008.07.08 -
Prevx1 V2 2008.07.09 -
Rising 20.52.22.00 2008.07.09 Trojan.Win32.Delf.ykq
Sophos 4.31.0 2008.07.09 -
Sunbelt 3.1.1509.1 2008.07.04 -
Symantec 10 2008.07.09 -
TheHacker 6.2.96.374 2008.07.07 -
TrendMicro 8.700.0.1004 2008.07.09 -
VBA32 3.12.6.8 2008.07.08 -
VirusBuster 4.5.11.0 2008.07.08 -
Webwasher-Gateway 6.6.2 2008.07.09 -
Information additionnelle
File size: 43520 bytes
MD5...: c3f86432af8761ebd044139752ae552d
SHA1..: 5b8f505bb176eae18afbe49f3098883b78c0e63c

[Malekal_morte]

Scan qq jours après :

Complete scanning result of "Sp7ua.exe", processed in VirusTotal at 07/12/2008 14:13:42 (CET).

[ file data ]
* name..: Sp7ua.exe
* size..: 43520
* md5...: c3f86432af8761ebd044139752ae552d
* sha1..: 5b8f505bb176eae18afbe49f3098883b78c0e63c
* peid..: BobSoft Mini Delphi -> BoB / BobSoft

[ scan result ]
AhnLab-V3 2008.7.11.0/20080711 found nothing
AntiVir 7.8.0.64/20080711 found [TR/Agent.ttu.1]
Authentium 5.1.0.4/20080711 found nothing
Avast 4.8.1195.0/20080712 found nothing
AVG 7.5.0.516/20080712 found [Worm/Generic.IQK]
BitDefender 7.2/20080712 found nothing
CAT-QuickHeal 9.50/20080711 found [Trojan.Agent.ttu]
ClamAV 0.93.1/20080711 found nothing
DrWeb 4.44.0.09170/20080712 found nothing
eSafe 7.0.17.0/20080710 found nothing
eTrust-Vet 31.6.5949/20080712 found nothing
Ewido 4.0/20080712 found nothing
F-Prot 4.4.4.56/20080711 found nothing
F-Secure 7.60.13501.0/20080712 found nothing
Fortinet 3.14.0.0/20080712 found [PossibleThreat]
GData 2.0.7306.1023/20080712 found [Trojan.Win32.Agent.ttu]
Ikarus T3.1.1.26.0/20080712 found [VirTool.Win32.DelfInject.AF]
Kaspersky 7.0.0.125/20080712 found [Trojan.Win32.Agent.ttu]
McAfee 5337/20080711 found nothing
Microsoft 1.3704/20080712 found [Worm:Win32/Slenfbot.ZE]
NOD32v2 3263/20080711 found [Win32/AutoRun.RM]
Norman 5.80.02/20080711 found nothing
Panda 9.0.0.4/20080712 found nothing
Prevx1 V2/20080712 found [Worm]
Rising 20.52.52.00/20080712 found [Trojan.Win32.Delf.ykq]
Sophos 4.31.0/20080712 found nothing
Sunbelt 3.1.1536.1/20080712 found [Trojan.Win32.Agent.ttu]
Symantec 10/20080712 found [Downloader]
TheHacker 6.2.96.376/20080710 found nothing
TrendMicro 8.700.0.1004/20080711 found nothing
VBA32 3.12.6.9/20080712 found nothing
VirusBuster 4.5.11.0/20080711 found nothing
Webwasher-Gateway 6.6.2/20080711 found [Trojan.Agent.ttu.1]