Top 10 malware reported to Sophos in October 2006

Apple Ships iPods with Windows Virus

Apple apologized Tuesday for shipping video iPods containing the Windows virus RavMonE.exe, which apparently made its way onto a small number of the ubiquitous devices at a manufacturing plant. Around 1 percent of units shipped after September 12, 2006 are affected.

RavMonE.exe is a mass storage virus that only affects Windows computers. According to antivirus vendors, which dub the malware Win32.RJump.a and Troj/Bdoor-DIJ, the virus is a Trojan that opens links to Web sites and allows others access to a computer.
 

  Read More

Worm inside McDonald's MP3 player promo

Winners of 10,000 MP3 players given away in a Japanese fast-food promotion won more than they bargained for, as their prizes contained a worm.

If they connected their new music players to their computers to fill them with songs then the worm, WORM_QQPASS.ADH, could infect the computers and steal personal data.
 

  Read More

SpamThru Trojan Analysis

Understanding the purpose of malware simply by searching anti-virus writeups can sometimes be a daunting task. Often, we see trojans which have painfully little information about their functionality other than "backdoor", or "keylogger", or "proxy". In many cases, widely varying trojans are given similar, non-descriptive names like "Trojan.Agent.abc", further adding to the murky view we have of just what modern malware is up to.

Sometimes, when we shine a light on a particular piece of malware, we find some interesting things that would otherwise go unnoticed. One such piece of malware is the trojan sometimes called "Troj/SpamThru", among other names.

Note that the current incarnation is not called SpamThru by any vendor who detects it in the above scan result from VirusTotal, however, by correlating behavior with previous writeups, it is apparent that it is the same trojan. Given that SpamThru is the most descriptive and unique name assigned to it, we have chosen to call it that in this writeup as well. Overall, detection by AV vendors is sparse, but that's to be expected given that SpamThru is a money-making operation, and the author takes great care to make sure that detection by the major vendors is avoided by frequently updating the code.

Although many trojans and viruses are turning to rootkits to hide their activities on a system, SpamThru uses little more than a few registry keys to keep its hold on the system. It uses the classic HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run key in order to launch at startup, but also tries to start from HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler and SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad just in case the Run key is removed.

The registry keys are named based on the trojan's control server port, so you might see any of the following at this time:

Basically SpamThru is designed to send spam from an infected computer. This type of operation is now years old, however, SpamThru has some new twists.

Peer-to-Peer Communication

SpamThru uses a custom P2P protocol in order to share information with other peers including the IP addresses and ports and software version of the control server, template servers, and all the peers they each know about. Control is still maintained by a central server, but in case the control server is shut down, the spammer can update the rest of the peers with the location of a new control server, as long as he/she controls at least one peer.

The network generally consists of one control server (running multiple peer-nets on different ports), several template servers, and around 500 peers per port. There appears to be a limit to how many peers each port can effectively control, as the overhead in sharing information between hosts is fairly large. The estimated number of infected hosts connected to the one control server we looked at was between one and two thousand across all open ports (however this is only counting IP addresses, which can skew the actual numbers due to on dynamic IPs and NAT.)

The protocol is binary-based and the initial packets usually begin with a header:

01 = protocol version?
68 73 35 70 00 = magic (hs5p\x00)

The header is followed by a one-byte command code, and any arguments to the command. The command codes we've seen are:

So far, the network appears to use 208.66.195.67 (bn.i-ru.net) as the sole control server, and the template servers seen are 208.66.193.26, 208.66.193.29, 216.255.178.170, 216.255.178.178, 216.255.182.202.

Read More here...