Re: [Full-Disclosure] Heads up: Possible lsass worm in the wild

[insecure <insecure@xxxxxxxxxxxxx>]

morning_wood wrote:

> dropped file: %SYSTEM%/msiwin84.exe
> remote process established to: lsass.exe
> remote ip:4.x.x.x
>
> note: file msiwin84.was not running
>
>
> this appears to be a "blaster" type of worm working on the first and / or
> second subset of the infected host to begin scanning for more hosts.
> I have not completly unpacked the binary but here is some strings.
>
> ------------------ snip --------------
> DnsFlushResolve
> {ache.dapi.dllVQUIT RIVMSG %s : screw you KGGo home  cCmd.Net, +MODEW ]m715
> 522947
> 6660M USERHOST/@ JOINFL :YnASSo DCC \ND " o:.bmp"Jd Error: fix>ipS enc<5n  clos
> *+h2(P/ t,O cu.g ACHO=Ds NEU(fkbit/s)  tal!x f@m'Q_  IP addrvs3
>
> ------------------ snip ---------------
>
> based on the above, the worm / viri tries to connect to a IRC server.
>
> anyone else experiencing this?
>
>
> morning_wood
> http://exploitlabs.com
>
>
>
>
>
>
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>
>  
According to McAfee, this is W32/Gaobot.worm.ali. It is not a "blaster" 
type worm, as it does not spread completely autonomously. It infects a 
system, contacts an IRC server, and waits for instructions, one of which 
can be to search for and infect other vulnerable systems. The IRC server 
is offline at the moment.

See http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=125006

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html