Nouveau rootkit: par mail sujet tempete

[Malekal_morte]

Un nouveau rootkit est apparu..
La propagation se fait par mail via Trojan-Downloader.Win32.Small.Dam

Un exemple de mail reçu :
230 dead as storm batters Europe.
A killer at 11, he's free at 21 and...
British Muslims Genocide
Naked teens attack home director.
U.S. Secretary of State Condoleezza...

Les pièces jointes sont :

Full Clip.exe
Full Story.exe
Read More.exe
Video.exe

Une fois installé... le rootkit créé le service wincom32 qui charge le driver wincom32.sys

Antivirus Version Update Result
AntiVir 7.3.0.21 01.17.2007 no virus found
Authentium 4.93.8 01.17.2007 no virus found
Avast 4.7.936.0 01.17.2007 no virus found
AVG 386 01.18.2007 no virus found
BitDefender 7.2 01.18.2007 no virus found
CAT-QuickHeal 9.00 01.17.2007 no virus found
ClamAV devel-20060426 01.18.2007 no virus found
DrWeb 4.33 01.17.2007 BackDoor.Groan
eSafe 7.0.14.0 01.17.2007 no virus found
eTrust-InoculateIT 23.73.116 01.18.2007 no virus found
eTrust-Vet 30.3.3332 01.17.2007 no virus found
Ewido 4.0 01.17.2007 Rootkit.Agent.dh
Fortinet 2.82.0.0 01.18.2007 no virus found
F-Prot 3.16f 01.17.2007 no virus found
F-Prot4 4.2.1.29 01.17.2007 no virus found
Ikarus T3.1.0.27 01.09.2007 no virus found
Kaspersky 4.0.2.24 01.18.2007 Rootkit.Win32.Agent.dh
McAfee 4941 01.17.2007 no virus found
Microsoft 1.1904 01.18.2007 no virus found
NOD32v2 1986 01.18.2007 no virus found
Norman 5.80.02 01.17.2007 no virus found
Panda 9.0.0.4 01.17.2007 no virus found
Prevx1 V2 01.18.2007 no virus found
Sophos 4.13.0 01.17.2007 no virus found
Sunbelt 2.2.907.0 01.12.2007 no virus found
TheHacker 6.0.3.148 01.14.2007 no virus found
UNA 1.83 01.17.2007 no virus found
VBA32 3.11.2 01.17.2007 no virus found
VirusBuster 4.3.19:9 01.17.2007 no virus found


Aditional Information
File size: 48512 bytes
MD5: a85d1a3e8ffcfd824f9ec05a7a1718c2
SHA1: 55c2461c280574d0ca2f20c88ed1768392cae63d


sources :
http://www.f-secure.com/weblog/archives ... l#00001086
http://www.f-secure.com/weblog/archives ... l#00001087
http://www.castlecops.com/modules.php?& ... c&t=177522
http://www.pcinpact.com/actu/news/34142 ... europe.htm

[Malekal_morte]

Un autre vers par mail :

Sujets des mails :
Russian missle shot down Chinese satellite
Russian missle shot down USA aircraft
Russian missle shot down USA satellite
Chinese missile shot down USA aircraft
Chinese missile shot down USA satellite
Sadam Hussein alive!
Sadam Hussein safe and sound!
Radical Muslim drinking enemies' blood.
U.S. Secretary of State Condoleezza Rice has kicked German Chancellor Angela Merkel

Fichiers attachés :

Video.exe
Full Video.exe
Read More.exe
Full Text.exe
Full Clip.exe

Une fois executé, il créé un botnet par P2P qui ouvre le port 7871/UDP
Il est détecté en Trojan-Downloader.Win32.Agent.bet.

Source : http://www.f-secure.com/weblog/archives ... l#00001088