[Prelude Hybrid IDS] #217: new row for relation "prelude_checksum" violates check constraint "prelude_checksum_algorithm_check"

#217: new row for relation "prelude_checksum" violates check constraint
"prelude_checksum_algorithm_check"
--------------------------+-------------------------------------------------
 Reporter:  bjou          |       Owner:  yoann
     Type:  defect        |      Status:  new  
 Priority:  normal        |   Milestone:       
Component:  libpreludedb  |     Version:  0.9  
 Severity:  normal        |    Keywords:       
--------------------------+-------------------------------------------------
 I am using nepenthes 0.2.0 in combination with prelude-manager 0.9.7.2,
 libprelude 0.9.13.2 and libpreludedb 0.9.12. Every time nepenthes
 downloads malware, it can not be logged into the prelude db (pgsql):

 [ info handler event module ] LogPrelude EVENT EV_SOCK_TCP_ACCEPT

 [ crit sc handler ] MATCH linkxor::link  matchCount 5 map_items 5

 [ info sc handler ]  i = 1 map_items 5 , map = size

 [ info sc handler ]  i = 2 map_items 5 , map = size

 [ info sc handler ]  i = 3 map_items 5 , map = key

 [ info sc handler ]  i = 4 map_items 5 , map = post

 [ info sc handler ] Found linkbot XOR decoder, key 0x17, payload is 0x00b2
 bytes long.

 [ info sc handler ] connectbackfiletransfer::linktransfer ->
 129.13.x.x:50391

 [ info sc handler ] connectbackfiletransfer::linktransfer ->
 129.13.x.x:50391, key 0x63f635d0.

 [ info handler event module ] LogPrelude EVENT EV_DOWNLOAD
 link://129.13.x.x:50391/Y/Y10A==  0

 [ info down mgr ] Handler link download handler will download
 link://129.13.x.x:50391/Y/Y10A==

 [ info handler event module ] LogPrelude EVENT EV_SHELLCODE_DONE

 [ info handler event module ] LogPrelude EVENT EV_ASSIGN_AND_DONE

 [ info handler event module ] LogPrelude EVENT EV_SOCK_TCP_CLOSE

 [ info handler dia ] Download via linkbot filetransferr done! ( download
 is 37888 bytes)

 [ info mgr submit ] File ed82850exxxxxxxxxxxxxxxxxxx has type MS-DOS
 executable, MZ for MS-DOS

 [ info handler event module ] LogPrelude EVENT EV_SUBMISSION

 link://129.13.x.x:50391/Y/Y10A== ed82850exxxxxxxxxxxxxxxxxxx 37888


 And that's what prelude-manager says:

 could not insert message into database: ERROR:  new row for relation
 "prelude_checksum" violates check constraint
 "prelude_checksum_algorithm_check".

 The only thing that is presented via prewikka is:

 7 x Shellcode detected: connectbackfiletransfer::linktransfer

 7 x possible Malware offered: link://129.13.x.x:50391/Y/Y10A==

 but NOT the message about the successful download of the malware

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/217>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel