Re: New Trojan on the block [CIA Trojan]
"Chris Norton" <[email protected]>
| Newsgroups | gmane.comp.security.intrusions |
|---|---|
| Message-ID | <[email protected]> |
[this was edited from the origanl reply sent to Nick for obvious reasons] Hello Nick, I submitted a Trojan that was found on my machine which was nothing but a downloader which we still don't know what the purpose of it was. The file I found on my machine is in fact caught by AV's. I was refering to the new CIA Trojan maker. I could have worded it better yes but it was about 3 AM in the morning lol. What I was trying to say is I ran the trojan [Win32/Small.ar] in vmware and monitored what site it was trying to access which was 213.46.226.xx 192.168.80.129 213.46.226.xx HTTP GET /zosman/cia/index.php HTTP/1.1 213.46.226.xx 192.168.80.129 HTTP HTTP/1.1 404 Not Found (text/html) So what I did was follow this and googled zosman/cia. I downloaded the trojan maker and droped it into vmware to see just what exactly it did. I noticed at first the file size was way bigger than the one I had on my system: CIA 1.23 size: 119kb made in: VB Win32/Small.ar size: 15kb made in: Delphi by someone named exxecs Why he was pointing this at the CIA website I have no idea and I guess we will never find out. But thats what made me stumble on to the new Trojan/Backdoor. Did this clear it up any? ------------------------------------------------------------- Chris Norton - UAT Student Software Engineering Network Defense _______________________________________________ Intrusions mailing list [email protected] http://www.dshield.org/mailman/listinfo/intrusions