New Trojan on the block [CIA Trojan]
"Chris Norton" <[email protected]>
| Newsgroups | gmane.comp.security.intrusions |
|---|---|
| Message-ID | <[email protected]> |
Hello everyone, After getting infected some how by a new trojan I submitted it to the fine folks at ISC and which it was dubbed Win32/Small.AR and was classified as a downloader trojan. Last night I decided to do an analysis of this trojan myself and after following and doing a quick google search for a one of the directories it called up when accessing a website I found the very same site would redirect me to another site in which you could download a new Server/Client trojan like the infamous Sub7. Some of the features of this new trojan are taken from the readme and will be shown at the end of this message. I have created the following snort rule to help detect any connections in or out from the trojan or it's server: alert ip any any -> any any (msg:"Possible CIA trojan activity"; content:"CIA 1."; content:"pass"; classtype:trojan-activity; sid:5000825; rev:1;) If anyone wants to make a better snort rule you are more than welcome to. As of this writing there are no known AV signatures available to detect this new trojan and there have been over 2,800 downloads from the website so this trojan is being used in the wild currently. ["Features" taken from the readme] Capture Screen/Webcam/Windows with greyscale jpeg's Improved CGI/PHP logging system ( logs country , Webcam & Operating System - Check Loggers Directory ) Server is Semi-Polymorhic sometimes only 7% The same signature ( packed with upx ) Dos Shell ( capture the output of remote commands ) Detailed Connection Monitor Grab Yahoo passwords in password recovery Dont Send Notify's if Detects LAN ( 192.*.*.* ) Detect Server Connection ( Modem / Lan / Proxy ) Get More Paths In Information Get Sound Card Driver in Info Get Drivers Info Cd Keys Updates ( Thx 2 Death-Wish who did all the hard work ) Delete Files By Path ( File Manager ) Enumerate Registry keys Added a webdloader ( download on install or control from client ) Get Recently opened media files Get recently searched files Get recently Opened files Get Recnetly Run Files Disable Command Prompt Enable Command Prompt Disable System Restore Enable System Restore Disable Task Manager Enable Task Manager Disable Registry Editor Enable Registry Editor Disable System Restore Disable Command Prompt _______________________________________________ Intrusions mailing list [email protected] http://www.dshield.org/mailman/listinfo/intrusions