.:Computer Defense:.

Another in my line of tutorial reposts.... I really need to finish up some stuff on this... it was just a small thing I played with... there are problems with it... but it will introduce the basics..
The original (with the code) can be found here

I will also attempt to add the code here in the next day or two.... (I've also got a couple smaller code releases planned)...

Due to errors with code formatting and my inability to get wordpress to display html without rendering it I'm going to attach the tutorial as a text file.

Download the Tutorial

Microsoft has released an Out-of-Band Update for the VML issue in IE.  I would suggest that everyone visit http://www.microsoft.com/technet/security/Bulletin/MS06-055.mspx to obtain this update and download it as soon as possible.

So I've done a little playing with this guy... primarily to watch his network behavior.. I'll run a second round with it either tonight or tomorrow and watch the file system and registry changes a little more closely...

After you run the infected file you are greated with a pop-up box that says update applied. A process (t2serv.exe, this will be confirmed on my next round of work), which is hidden from taskman and tasklist seems to carry out the remainder of the process.

From a network point of view, the following occurs.

1. DNS Query - MX Record - yahoo.com
2. DNS Query - A Record - mx1.mail.yahoo.com
3. 4 TCP Packets (SYN) to mx1.mail.yahoo.com (each IP address associated with it)
4. DNS Query - A Record - www4.vertionkdaseliplim.com
5. TCP Request to www4.vertionkdaseliplim.com:80
6. HTTP/1.1 GET Request - /chr/grv/lt.exe
7. DNS Query - MX Record - gmail.com
8. 4 TCP Packets (SYN) to gmail.com MX (each IP)
9. DNS Query - MX Record - hotmail.com
10. 4 TCP Packets (SYN) to hotmail.com MX (each IP)
11. DNS Query - A Record - www3.vertionkdaseliplim.com
12. TCP Request to www3.vertionkdaseliplim.com:80
13. HTTP/1.1 POST - /cgi-bin/pr.cgi - POST Data == Ver=3.01&lid=5A6391F158F84B309FCA&type=s&p=0&r=1&m=2&
14. DNS Query - A Record - www6.vertionkdaseliplim.com
15. TCP Request to www6.vertionkdaseliplim.com:80
16. HTTP/1.1 GET Request - /chr/grv/nt.exe (404 Not Found)
17. DNS Query - A Record - www2.vertionkdaseliplim.com
18. TCP Request to www2.vertionkdaseliplim.com:80
19. HTTP/1.1 POST - /cgi-bin/pr.cgi
20. POST Data == Ver=3.01&lid=5A6391F158F84B309FCA&type=a&n=0&
21. DNS Query - A Record - www2.vertionkdaseliplim.com
22. TCP Request to www2.vertionkdaseliplim.com:80
23. HTTP/1.1 POST - /dsl2 - Post Data = List of harvest addresses (addresses must have been pulled from IE/Firefox cache based on what they were)

Since nt.exe already seems to be gone, I've obtained and stored a copy of lt.exe in case anyone would like a copy. I'll keep everyone in the loop as I dig further into this.

Peace,
HT

I was just about to head off to work when I did one last check of my email... and what do I see but an email with the subject 'Mail Server Report'... The address doesn't look familiar, but I've received a few of these lately from various mailing list submissions. This was the content of the email I opened:

----

Mail server report.

Our firewall determined the e-mails containing worm copies are being sent from your computer.

Nowadays it happens from many computers, because this is a new virus type (Network Worms).

Using the new bug in the Windows, these viruses infect the computer unnoticeably.
After the penetrating into the computer the virus harvests all the e-mail addresses and sends the copies of itself to these e-mail
addresses

Please install updates for worm elimination and your computer restoring.

Best regards,
Customers support service
----

I'm rather impressed.... these bastards are getting slicker and slicker.... or maybe this has been around for a while and I just don't pay much attention... Attached to the email was the file Update-KB8375-x86.zip.

I submitted the file to VirusTotal and here's what I got back: