Picture9.zip / Backdoor.Win32.IRCBot.dyn

[Malekal_morte]

Se propage par le fichier contenant le fichier Picture9.zip (se trouve dans %windir%) contenant le fichier mypicture009.JPG-www.myspace.com

Message de propagation :

do you mind if I upload this picture to my new profile?
have you seen the last picture I created in photoshop?
I just found this wallpaper, I think its PERFECT for you!
You missed out on the party! It was pretty intense, just look!
can I post this picture of you on my blog?

L'infection ajoute la ligne suivante sur HijackThis :

O4 - HKLM\..\Run: [Windows Driver Sup] windvrhost.exe

Fichier euSp5x.exe reçu le 2008.07.05 23:27:25 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
Résultat: 1/33 (3.04%)

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.7.4.1 2008.07.05 -
AntiVir 7.8.0.64 2008.07.05 -
Authentium 5.1.0.4 2008.07.04 -
Avast 4.8.1195.0 2008.07.05 -
AVG 7.5.0.516 2008.07.05 -
BitDefender 7.2 2008.07.05 -
CAT-QuickHeal 9.50 2008.07.04 -
ClamAV 0.93.1 2008.07.05 -
DrWeb 4.44.0.09170 2008.07.05 -
eSafe 7.0.17.0 2008.07.03 -
eTrust-Vet 31.6.5929 2008.07.05 -
Ewido 4.0 2008.07.05 -
F-Prot 4.4.4.56 2008.07.04 -
F-Secure 7.60.13501.0 2008.07.03 -
Fortinet 3.14.0.0 2008.07.05 -
GData 2.0.7306.1023 2008.07.05 -
Ikarus T3.1.1.26.0 2008.07.05 -
Kaspersky 7.0.0.125 2008.07.05 -
McAfee 5332 2008.07.04 -
Microsoft 1.3704 2008.07.05 -
NOD32v2 3244 2008.07.05 -
Norman 5.80.02 2008.07.04 -
Panda 9.0.0.4 2008.07.05 -
Prevx1 V2 2008.07.05 -
Rising 20.51.42.00 2008.07.04 Trojan.Win32.Delf.ykq
Sophos 4.31.0 2008.07.05 -
Sunbelt 3.1.1509.1 2008.07.04 -
Symantec 10 2008.07.05 -
TheHacker 6.2.96.373 2008.07.05 -
TrendMicro 8.700.0.1004 2008.07.05 -
VBA32 3.12.6.8 2008.07.05 -
VirusBuster 4.5.11.0 2008.07.05 -
Webwasher-Gateway 6.6.2 2008.07.05 -
Information additionnelle
File size: 43520 bytes
MD5...: 90f41a3511c3ffbba20ccc90e164441f
SHA1..: 9724c344a3bfb255c915b3ea8cbe8672fc694bc6

[Malekal_morte]

Scan quelques jours après...

Complete scanning result of "euSp5x.exe", processed in VirusTotal at 07/08/2008 01:22:28 (CET).

[ file data ]
* name..: euSp5x.exe
* size..: 43520
* md5...: 90f41a3511c3ffbba20ccc90e164441f
* sha1..: 9724c344a3bfb255c915b3ea8cbe8672fc694bc6
* peid..: BobSoft Mini Delphi -> BoB / BobSoft

[ scan result ]
AhnLab-V3 2008.7.8.0/20080707 found [Win-Trojan/Injector.43520]
AntiVir 7.8.0.64/20080707 found nothing
Authentium 5.1.0.4/20080707 found nothing
Avast 4.8.1195.0/20080707 found nothing
AVG 7.5.0.516/20080707 found nothing
BitDefender 7.2/20080708 found nothing
CAT-QuickHeal 9.50/20080707 found nothing
ClamAV 0.93.1/20080708 found nothing
DrWeb 4.44.0.09170/20080707 found nothing
eSafe 7.0.17.0/20080707 found nothing
eTrust-Vet 31.6.5934/20080707 found nothing
Ewido 4.0/20080707 found nothing
F-Prot 4.4.4.56/20080707 found nothing
F-Secure 7.60.13501.0/20080703 found nothing
Fortinet 3.14.0.0/20080707 found nothing
GData 2.0.7306.1023/20080708 found [Backdoor.Win32.IRCBot.dyn]
Ikarus T3.1.1.26.0/20080707 found nothing
Kaspersky 7.0.0.125/20080708 found [Backdoor.Win32.IRCBot.dyn]
McAfee 5333/20080707 found nothing
Microsoft 1.3704/20080708 found [Worm:Win32/Slenfbot.ZA]
NOD32v2 3248/20080707 found [Win32/AutoRun.RM]
Norman 5.80.02/20080707 found nothing
Panda 9.0.0.4/20080708 found nothing
Prevx1 V2/20080708 found [Worm]
Rising 20.51.60.00/20080706 found [Trojan.Win32.Delf.ykq]
Sophos 4.31.0/20080707 found nothing
Sunbelt 3.1.1509.1/20080704 found nothing
Symantec 10/20080708 found [Trojan.Dropper]
TheHacker 6.2.96.374/20080707 found nothing
TrendMicro 8.700.0.1004/20080707 found nothing
VBA32 3.12.6.8/20080707 found nothing
VirusBuster 4.5.11.0/20080707 found nothing
Webwasher-Gateway 6.6.2/20080707 found nothing