AplusWebMaster
Topic Starter
FYI…
- http://isc.sans.org/diary.html?storyid=2397
Last Updated: 2007-03-10 16:25:08 UTC …(Version: 3) ~ "…The airindia.com website contained a script-tag linking to a malicious Javascript hosted on a Chinese web server. We were able to confirm this and contacted Airindia to inform them their site had likely been compromised. At this point in time, the site is clean again. Initial verification shows that this malicious link has been introduced into a large number of sites, both through script injection in forms as well as ways that look very much like web server compromise to us.
If you have a large installed base of Windows machines with browsing access, you may wish to review your proxy logs for requests for the following files. We removed the actual domain as to not to link directly to the actual malware.
[xxx] .cn/images/163.js
[xxx] .cn/images/sina.htm
The file downloaded upon succesful execution is called 'install.exe' and has an md5 checksum of f9fc3189d619462f6c939bfbf36c90ab. Once executed, it installs three files on the system, 'winboot.exe', 'winroot.bat' and '1.exe', of which the latter remains resident in memory. The software seems to be a keylogger at this point in time. Anti-virus detection for this malware was non-existent this morning.
Currently, virustotal shows succesful detection by:
AntiVir 7.3.1.41 03.09.2007 TR/Crypt.FKM.Gen
CAT-QuickHeal 9.00 03.10.2007 (Suspicious) - DNAScan
eSafe 7.0.14.0 03.08.2007 Suspicious Trojan/Worm
Kaspersky 4.0.2.24 03.10.2007 Trojan-PSW.Win32.WOW.pu
Sunbelt 2.2.907.0 03.10.2007 VIPRE.Suspicious
Symantec 10 03.10.2007 Infostealer.Wowcraft
VBA32 3.11.2 03.10.2007 suspected of Downloader.Dadobra.10 (paranoid heuristics)
F-Secure, Fortinet and Sophos confirmed to us by e-mail they would be adding detection shortly…"
- http://isc.sans.org/diary.html?storyid=2397
Last Updated: 2007-03-10 16:25:08 UTC …(Version: 3) ~ "…The airindia.com website contained a script-tag linking to a malicious Javascript hosted on a Chinese web server. We were able to confirm this and contacted Airindia to inform them their site had likely been compromised. At this point in time, the site is clean again. Initial verification shows that this malicious link has been introduced into a large number of sites, both through script injection in forms as well as ways that look very much like web server compromise to us.
If you have a large installed base of Windows machines with browsing access, you may wish to review your proxy logs for requests for the following files. We removed the actual domain as to not to link directly to the actual malware.
[xxx] .cn/images/163.js
[xxx] .cn/images/sina.htm
The file downloaded upon succesful execution is called 'install.exe' and has an md5 checksum of f9fc3189d619462f6c939bfbf36c90ab. Once executed, it installs three files on the system, 'winboot.exe', 'winroot.bat' and '1.exe', of which the latter remains resident in memory. The software seems to be a keylogger at this point in time. Anti-virus detection for this malware was non-existent this morning.
Currently, virustotal shows succesful detection by:
AntiVir 7.3.1.41 03.09.2007 TR/Crypt.FKM.Gen
CAT-QuickHeal 9.00 03.10.2007 (Suspicious) - DNAScan
eSafe 7.0.14.0 03.08.2007 Suspicious Trojan/Worm
Kaspersky 4.0.2.24 03.10.2007 Trojan-PSW.Win32.WOW.pu
Sunbelt 2.2.907.0 03.10.2007 VIPRE.Suspicious
Symantec 10 03.10.2007 Infostealer.Wowcraft
VBA32 3.11.2 03.10.2007 suspected of Downloader.Dadobra.10 (paranoid heuristics)
F-Secure, Fortinet and Sophos confirmed to us by e-mail they would be adding detection shortly…"