Security Incidents: Re: Trojan program

[H C <keydet89 () yahoo com>]

Have you done any analysis of the "iexplore.exe" file,
such at gathering the MAC times from the file, seeing
if there is any information in the resource section of
the file, or run 'strings' on it?

Have you recorded the LastWrite times from the
Registry keys in question?

Have you conducted a search of any of the anti-virus
web sites with regards to 'iexplore.exe'?

--- Mike Peterson <slidefx () yahoo com> wrote:
> Does anyone have information on a IRC Trojan with
> the
> following characteristics.
>
> Opens IRC channels on 6667 and connects to some IRC
> channel on 6668.
>
> It sets a registry key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Default
> web browser  =  "c:\winnt\system32\iexplore.exe"
>
> And changes the shell
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\Shell
> changes it from "Explorer.exe" to "Explorer.exe
> iexplore.exe"
>
> I found a 9 KB file named iexplore.exe in
> c:\winnt\system32 and also found the iexplore.exe
> process running.
>
> Norton Antivirus did not catch the Trojan
>
> Here is some of the network traffic
>
> Frame   Time    Src MAC Addr   Dst MAC Addr  
> Protocol
>  Description                                        
>  
>             Src Other Addr  Dst Other Addr  Type
> Other
> Addr
> 110     5.159   G7SUJ          NICSRV01       TCP   
>  
>  .AP..., len:   26, seq:  67030892-67030917,
> ack:3550877285, win:  G7SUJ           209.116.7.97  
>
> IP
>
> + FRAME: Base frame properties
> + ETHERNET: ETYPE = 0x0800 : Protocol = IP:  DOD
> Internet Protocol
> + IP: ID = 0x612A; Proto = TCP; Len: 66
>
> page 31
> 
>
> Network Monitor trace  Fri 10/19/01 07:47:37 
> trojan.TXT
>
> + TCP: .AP..., len:   26, seq:  67030892-67030917,
> ack:3550877285, win: 8280, src: 8184  dst: 6668 
>
> 00000:  00 00 0C 07 AC 47 00 B0 D0 1A 49 5C 08 00 45
> 00   .....G....I\..E.
> 00010:  00 42 61 2A 00 00 80 06 AF D9 0A 68 46 75 D1
> 74   .Ba*.......hFu.t
> 00020:  07 61 1F F8 1A 0C 03 FE CF 6C D3 A6 16 65 50
> 18   .a.......l...eP.
> 00030:  20 58 0F CE 00 00 55 53 45 52 20 63 68 78 76
> 20    X....USER chxv 
> 00040:  69 78 64 6F 20 70 6E 6A 68 20 3A 61 64 6F 61
> 0A   ixdo pnjh :adoa.
>
> Frame   Time    Src MAC Addr   Dst MAC Addr  
> Protocol
>  Description                                        
>  
>             Src Other Addr  Dst Other Addr  Type
> Other
> Addr
> 113     5.214   0004DD749F42   G7SUJ          TCP   
>  
>  .AP..., len:   68, seq:3550877285-3550877352, ack: 
> 67030892, win 209.116.7.97    G7SUJ           IP
>
> + FRAME: Base frame properties
> + ETHERNET: ETYPE = 0x0800 : Protocol = IP:  DOD
> Internet Protocol
> + IP: ID = 0x8DED; Proto = TCP; Len: 108
> + TCP: .AP..., len:   68, seq:3550877285-3550877352,
> ack:  67030892, win: 4140, src: 6668  dst: 8184 
>
> 00000:  00 B0 D0 1A 49 5C 00 04 DD 74 9F 42 08 00 45
> 00   ....I\...t.B..E.
> 00010:  00 6C 8D ED 40 00 2E 06 94 EC D1 74 07 61 0A
> 68   .l.. ()       t a h
> 00020:  46 75 1A 0C 1F F8 D3 A6 16 65 03 FE CF 6C 50
> 18   Fu.......e...lP.
> 00030:  10 2C B2 D6 00 00 3A 64 72 61 67 6F 6E 73 2E
> 67   .,....:dragons.g
> 00040:  61 2E 75 73 2E 64 61 6C 2E 6E 65 74 20 4E 4F
> 54   a.us.dal.net NOT
>
> Frame   Time    Src MAC Addr   Dst MAC Addr  
> Protocol
>  Description                                        
>  
>             Src Other Addr  Dst Other Addr  Type
> Other
> Addr
> 127     5.516   G7SUJ          NICSRV01       TCP   
>  
>  .AP..., len:   32, seq:  67030928-67030959,
> ack:3550879444, win:  G7SUJ           209.116.7.97  
>
> IP
>
> + FRAME: Base frame properties
> + ETHERNET: ETYPE = 0x0800 : Protocol = IP:  DOD
> Internet Protocol
> + IP: ID = 0x692A; Proto = TCP; Len: 72
> + TCP: .AP..., len:   32, seq:  67030928-67030959,
> ack:3550879444, win: 8280, src: 8184  dst: 6668 
>
> 00000:  00 00 0C 07 AC 47 00 B0 D0 1A 49 5C 08 00 45
> 00   .....G....I\..E.
> 00010:  00 48 69 2A 00 00 80 06 A7 D3 0A 68 46 75 D1
> 74   .Hi*.......hFu.t
> 00020:  07 61 1F F8 1A 0C 03 FE CF 90 D3 A6 1E D4 50
> 18   .a............P.
> 00030:  20 58 76 C4 00 00 4A 4F 49 4E 20 23 77 68 6F
> 7A    Xv...JOIN #whoz
> 00040:  79 65 72 64 61 64 64 79 20 72 61 74 70 61 63
> 6B   yerdaddy ratpack
>
>
> I know that I will need to rebuild the machine, but
> does anyone have experience with this one?  I looked
> at the Run key a number of times before I realized
> the
> Default Web Browser key doesn't fit in.
>
> Mike
>
>
>
>
>
>
> __________________________________________________
> Do You Yahoo!?
> Make a great connection at Yahoo! Personals.
> http://personals.yahoo.com
----------------------------------------------------------------------------
> This list is provided by the SecurityFocus ARIS
> analyzer service.
> For more information on this free incident handling,
> management 
> and tracking system please see:
> http://aris.securityfocus.com

__________________________________________________
Do You Yahoo!?
Make a great connection at Yahoo! Personals.
http://personals.yahoo.com

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com