From: "sgopus" <
[email protected]>
| you would think that MS would have blocked or removed this latest batch of
| 615 spams about warez&Games, most likely they contain some virus and malware
| along with spyware, hopefully nobody tries to open them.
That was NOT spam.
That was a malware stream.
What you saw was only the third part of a 3 part multi-post. The MS News Server limits
the size of attachments and thus blocked posts for parts 1 and 2. However post part 3 was
small enough to make it to the server.
Combined they comprised of a RAR file that contained an EXE. That EXE was extremely
poorly detected.
http://www.virustotal.com/analisis/b977bacf32bbe0ee034c503de03f4231
Norman 6.00.06 2009.03.10 W32/Smalldoor.DRWN
What was detected did NOT reflect the fact its was a password/data stealer.
The data stolen would be would use FTP to post the data to a FTP server in Germany.
Files created:
%Temp%\cho.txt
%Temp%\fire.txt
%Temp%\ie.txt
%Temp%\key.txt
%Temp%\dial.txt
%Temp%\mail.txt
%Temp%\msg.txt
%Temp%\ps.txt
%Temp%\ste.txt
%Temp%\%UserName%@%ComputerName%.html
FTP Connection:
ftp.wuda101.wu.ohost.de:21
Username: wuda101
Password: wudxxxxxx { password obfucasted to protect user data }
Otherwise your basic "SC Lite Stealer" based trojan.
