To report a botnet PRIVATELY please email: [EMAIL PROTECTED]
----------
---------- Forwarded message ----------
From: [EMAIL PROTECTED] <[EMAIL PROTECTED]>
Date: 29-Apr-2006 11:50
Subject: [SANDBOX] Uploaded from web
Norman Scanner Engine 5.90. 7
Sandbox 05.90, dated 24/03-2006
Your message ID (for later reference): 20060429-061
nepenthes-31c9147230a3caff162dfeceb3fe3a7a-asn2.exe : [SANDBOX]
contains a security risk - W32/Spybot.gen3 (Signature:
W32/Spybot.AKCY)
[ General information ]
* **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: [EMAIL PROTECTED]
- REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**.
* Decompressing UPX.
* **Locates window "NULL [class mIRC]" on desktop.
* File length: 74240 bytes.
* MD5 hash: 31c9147230a3caff162dfeceb3fe3a7a.
[ Changes to filesystem ]
* Creates file C:\WINDOWS\SYSTEM32\xagw.exe.
* Deletes file 1.
[ Changes to registry ]
* Creates value "Windows ASN2 Services"="xagw.exe" in key
"HKLM\Software\Microsoft\Windows\CurrentVersion\Run".
* Creates value "Windows ASN2 Services"="xagw.exe" in key
"HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices".
* Sets value "restrictanonymous"="" in key
"HKLM\System\CurrentControlSet\Control\Lsa".
* Sets value "restrictanonymoussam"="" in key
"HKLM\System\CurrentControlSet\Control\Lsa".
[ Network services ]
* Looks for an Internet connection.
* Connects to "dynamic1084.amdwebhost.com" on port 6667 (TCP).
* Connects to IRC server.
* IRC: Uses password R4DRR4KZ6ZD3.
* IRC: Uses nickname aSNb-8034002.
* IRC: Uses username ezkieyaca.
* IRC: Joins channel #asn2 with password PdIAykAD.
* IRC: Sets the usermode for user aSNb-8034002 to .
* Attempts to delete share named "IPC$" on local system.
* Attempts to delete share named "ADMIN$" on local system.
* Attempts to delete share named "C$" on local system.
* Attempts to delete share named "D$" on local system.
[ Process/window information ]
* Creates a mutex rzasnb.
* Will automatically restart after boot (I'll be back...).
[ Signature Scanning ]
* C:\WINDOWS\SYSTEM32\xagw.exe (74240 bytes) : W32/Spybot.AKCY.
(C) 2004-2006 Norman ASA. All Rights Reserved.
The material presented is distributed by Norman ASA as an information
source only.
Received 29.Apr 2006 at 00.54 - processed 29.Apr 2006 at 01.50.
_______________________________________________
To report a botnet PRIVATELY please email: [EMAIL PROTECTED]
All list and server information are public and available to law enforcement
upon request.
http://www.whitestar.linuxbox.org/mailman/listinfo/botnets
