Re: Interesting little piece of malware...
don murdoch <[email protected]>
| Newsgroups | gmane.comp.security.intrusions |
|---|---|
| Message-ID | <[email protected]> |
All - I have it on firm authority from one of our system engineers that the BotNet visiting my U. has the ability to enumerate accounts from the SAM, blast a huge password list against it, and actually zap a machine w/ the same password as a user name. There was a "mitigating event" today at work. We are continuing to take prudent steps to deal, and seeing IRC traffic on non standard ports from +1024 ports ... and seeing that the executable name is changing (randomizing), but the MD5s are the same (interesting wrinkle, eh)? Basically - we are being attacked in the traditional way that an attacker goes about collecting a BotArmy. And we are stepping up, dealing, etc ... and it is quite an education!!!! HA! Also - we are at a < 5% threshold ... Don "stressed, depressed, and taking names" M. _______________________________________________ Intrusions mailing list [email protected] http://www.dshield.org/mailman/listinfo/intrusions