Re: New Trojan on the block [CIA Trojan]

"Chris Norton" <[email protected]>
Newsgroups gmane.comp.security.intrusions
Message-ID <[email protected]>
[this was edited from the origanl reply sent to Nick for obvious reasons]

Hello Nick,

I submitted a Trojan that was found on my machine which was nothing but a
downloader which we still don't know what the purpose of it was. The file I
found on my
machine is in fact caught by AV's. I was refering to the new CIA Trojan
maker. I could have
worded it better yes but it was about 3 AM in the morning lol. What I was
trying to say is I ran
the trojan [Win32/Small.ar] in vmware and monitored what site it was trying
to access which was
213.46.226.xx

192.168.80.129        213.46.226.xx         HTTP     GET
/zosman/cia/index.php HTTP/1.1

213.46.226.xx         192.168.80.129        HTTP     HTTP/1.1 404 Not
Found (text/html)

So what I did was follow this and googled zosman/cia.
I downloaded the trojan maker and droped it into vmware to
see just what exactly it did. I noticed at first the file size was
way bigger than the one I had on my system:

 CIA 1.23 size: 119kb made in: VB
Win32/Small.ar size: 15kb made in: Delphi by someone named exxecs

Why he was pointing this at the CIA website
I have no idea and I guess we will never find out. But thats what
made me stumble on to the new Trojan/Backdoor.
Did this clear it up any?

-------------------------------------------------------------
Chris Norton - UAT Student Software Engineering Network Defense
_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.