RejiMC: could you paste some of the test/urls they paste?
This are the text strings I found in one of the trojans:
i am bz now plz see my erotic video at
http://www.powow.com/erotica/myvideo.exe
i am bz now plz see my erotic video at
http://www.megaone.com/erotica/myvideo.exe
i am bz now plz see my erotic video at
http://www.koolpages.com/erotic/myvideo.exe
i am bz now plz see my erotic video at
http://www.cyberturf.com/erotica/myvideo.exe
wanna see my erotic video ? it is here
http://www.powow.com/erotica/myvideo.exe
wanna see my erotic video ? it is here
http://www.megaone.com/erotica/myvideo.exe
wanna see my erotic video ? it is here
http://www.koolpages.com/erotic/myvideo.exe
wanna see my erotic video ? it is here
http://www.cyberturf.com/erotica/myvideo.exe
see my erotic video at
http://www.powow.com/erotica/myvideo.exe
see my erotic video at
http://www.megaone.com/erotica/myvideo.exe
see my erotic video at
http://www.koolpages.com/erotic/myvideo.exe
see my erotic video at
http://www.cyberturf.com/erotica/myvideo.exe
brb. uploading my erotic video at
http://www.powow.com/erotica/myvideo.exe
brb. uploading my erotic video at
http://www.megaone.com/erotica/myvideo.exe
brb. uploading my erotic video at
http://www.koolpages.com/erotic/myvideo.exe
brb. uploading my erotic video at
http://www.cyberturf.com/erotica/myvideo.exe
wait a minute plz. i am updating my site
http://www.powow.com/erotica/myvideo.exe
wait a minute plz. i am updating my site
http://www.megaone.com/erotica/myvideo.exe
wait a minute plz. i am updating my site
http://www.koolpages.com/erotic/myvideo.exe
wait a minute plz. i am updating my site
http://www.cyberturf.com/erotica/myvideo.exe
However, when trying to run this trojan (in an isolated environment [sandbox] of course) it didn't run.. just an installer error and that's all.... I was able to find the .ini files etc however, that's how I got these strings...
The servers list they use has over 1000 entries and the nicklist is also insane big.
Anyway, I probably got some bad variant, because when I joined one of their mainchans (which they always join) I only saw 6 infected users. Perhaps you got some other nice one? ;)
This sig is in CVS now, but I still would like to know how this thing is called and if it's more widespread... I still got the feeling it is some kind of variant of something much more general/bigger..
Code: Select all
spamfilter {
regex "(^wait a minute plz\. i am updating my site|.*my erotic video).*http://.+/erotic(a)?/myvideo\.exe$";
target private;
action block;
reason "Infected by some trojan (erotica?)";
};