Re: New Trojan on the block [CIA Trojan]

Chris Norton wrote:

> As far as CIA goes thats what the group who coded it is calling it [not
> refering to the government agency] as taken from the readme file CIA 1.23 PB
> 1 ( Public Beta 1 ) ...

This being but one of dozens of obvious reasons why intelligent anti-
malware folk do not name things as their makers wish...

<<rest snipped>>

I'm intrigued that, according to your first post, you "submitted it to 
the fine folks at ISC" and later seem surprised/upset/concerned that no 
AV detect it yet:

   As of this writing there are no known AV signatures available to
   detect this new trojan and there have been over 2,800 downloads...

   ...but the actual client program that infects the machines still
   goes by undetected.

I have no reason to believe the "fine folks at ISC" will not have, 
eventually, forwarded samples to their antivirus contacts, but sending 
such suspect code to a network traffic reporting group, where malware 
research would seem to be at least a secondary priority, is surely 
introducing at least one, if not several, unnecessary delays to the 
process of getting AV detection for something new and perhaps already 
deployed to close to three thousand machines.

For your future reference, here is my standard list of well-known major 
AV developer suspect file submission addresses.  Note that nowadays it 
is probably advisable to use the submission method listed for 
NAI/McAfee for all these addresses (and mention in the accompanying 
message body that the .ZIP is encrypted and what the password is).

   Authentium (Command Antivirus)  <[email protected]>
   Computer Associates (US)        <[email protected]>
   Computer Associates (Vet/EZ)    <[email protected]>
   DialogueScience (Dr. Web)       <[email protected]>
   Eset (NOD32)                    <[email protected]>
   F-Secure Corp.                  <[email protected]>
   Frisk Software (F-PROT)         <[email protected]>
   Grisoft (AVG)                   <[email protected]>
   H+BEDV (AntiVir, Vexira engine) <[email protected]>
   Kaspersky Labs                  <[email protected]>
   Network Associates (McAfee)     <[email protected]>
     (use a ZIP file with the password 'infected' without the quotes)
   Norman (NVC)                    <[email protected]>
   Panda Software                  <[email protected]>
   Sophos Plc.                     <[email protected]>
   Symantec (Norton)               <[email protected]>
   Trend Micro (PC-cillin)         <[email protected]>
     (Trend may only accept files from users of its products)

Most of these addresses are monitored either by 24x365 malware support 
and analysis teams, or have distributed processing around the globe 
providing (close to) 24x365 coverage.  Several have automated code 
analysis systems that get the "first look" at submitted files, 
classifying them for further attention or simply sending back canned 
reports of the "we detect it in the DEF update that should ship at X or 
you can download a pre-QA copy at Y".  Depending on the nature of the 
files you submit, you should get several quite prompt responses, at 
some of which you'll have to ignore (e.g. a downloader detection is 
pretty meaningless as the target of a downloader is usually considered 
to be a non-code variable and ignored by any semi-intelligent detection 
of that downloader, so the same downloader can be used multiple times 
configured to snag stuff from different URLs and will always be 
detected as the same downloader and variant).


-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854

_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions