http://www.virustotal.com/analisis/baccc58a407108294e1d9e245ca75273
This trojan creates a file called rs32net.exe in the %system% folder (generally C:\Windows\System for 9x, System32 for 2000 and above), and connects to the following on port 80;
216.195.56.22
208.66.195.71
208.66.195.15
... it also rather kindly, creates an entry in the registry so it runs each time the computer boots;
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rs32net
The e-mail seems to want to both insult us younger folk (heh!) and keep things as short as possible, simply stating;
Hello, old chap.
Watch my tits!
Thanks.
Watch my tits!
Thanks.
Ah the joys .....
Exported by: Outlook Export v0.1.2
From: Rodney Estrada
E-mail:seamus.danby@acg-wien.at [ 80.243.163.49 - www29.world4you.com ]
Date: 23/09/2008 03:24:48
Subject: Exclusive photos, you'll be happy
**************************************************************************
Links
**************************************************************************
**************************************************************************
Text Version
**************************************************************************
Hello, old chap.
Watch my tits!
Thanks.
**************************************************************************
HTML Version
**************************************************************************
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7036.0">
<TITLE></TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>Hello, old chap.<BR>
<BR>
Watch my tits!<BR>
<BR>
Thanks.<BR>
</FONT>
</P>
</BODY>
</HTML>
**************************************************************************
Headers
**************************************************************************
Return-Path: <seamus.danby@acg-wien.at>
Delivered-To: services@[RMVD]
Received: from Postfix filter 42a77884ce2a0a03efc6bb50a6dcdb21 (localhost.localdomain [127.0.0.1])
by smtp-in-165.livemail.co.uk (Postfix) with SMTP id 97ACFEB0098
for <services@[RMVD]>; Tue, 23 Sep 2008 03:24:55 +0100 (BST)
Received: from ip-154-105-net.express.net.id (ip-154-105-net.express.net.id [203.153.105.154])
by smtp-in-165.livemail.co.uk (Postfix) with ESMTP id 0272DEB0098
for <jane@[RMVD]>; Tue, 23 Sep 2008 03:24:52 +0100 (BST)
Received: from [203.153.105.154] by mail.acg-wien.at; Tue, 23 Sep 2008 10:24:48 +0800
Message-ID: <01c91d66$9aef1800$9a6999cb@seamus.danby>
From: "Rodney Estrada" <seamus.danby@acg-wien.at>
To: <jane@[RMVD]>
Subject: Exclusive photos, you'll be happy
Date: Tue, 23 Sep 2008 10:24:48 +0800
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0006_01C91D66.9AEF1800"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 4.71.2244.8
X-MimeOLE: Produced By Microsoft MimeOLE V4.71.2244.8
X-Original-To: jane@[RMVD]
From: Rodney Estrada
E-mail:seamus.danby@acg-wien.at [ 80.243.163.49 - www29.world4you.com ]
Date: 23/09/2008 03:24:48
Subject: Exclusive photos, you'll be happy
**************************************************************************
Links
**************************************************************************
**************************************************************************
Text Version
**************************************************************************
Hello, old chap.
Watch my tits!
Thanks.
**************************************************************************
HTML Version
**************************************************************************
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7036.0">
<TITLE></TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>Hello, old chap.<BR>
<BR>
Watch my tits!<BR>
<BR>
Thanks.<BR>
</FONT>
</P>
</BODY>
</HTML>
**************************************************************************
Headers
**************************************************************************
Return-Path: <seamus.danby@acg-wien.at>
Delivered-To: services@[RMVD]
Received: from Postfix filter 42a77884ce2a0a03efc6bb50a6dcdb21 (localhost.localdomain [127.0.0.1])
by smtp-in-165.livemail.co.uk (Postfix) with SMTP id 97ACFEB0098
for <services@[RMVD]>; Tue, 23 Sep 2008 03:24:55 +0100 (BST)
Received: from ip-154-105-net.express.net.id (ip-154-105-net.express.net.id [203.153.105.154])
by smtp-in-165.livemail.co.uk (Postfix) with ESMTP id 0272DEB0098
for <jane@[RMVD]>; Tue, 23 Sep 2008 03:24:52 +0100 (BST)
Received: from [203.153.105.154] by mail.acg-wien.at; Tue, 23 Sep 2008 10:24:48 +0800
Message-ID: <01c91d66$9aef1800$9a6999cb@seamus.danby>
From: "Rodney Estrada" <seamus.danby@acg-wien.at>
To: <jane@[RMVD]>
Subject: Exclusive photos, you'll be happy
Date: Tue, 23 Sep 2008 10:24:48 +0800
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0006_01C91D66.9AEF1800"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 4.71.2244.8
X-MimeOLE: Produced By Microsoft MimeOLE V4.71.2244.8
X-Original-To: jane@[RMVD]
Posts
No comments:
Post a Comment