-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 All: CANADA.EXE (aka HOT CANADA) is a "dialer" by nature. In fact, a known dialer: http://www.pestpatrol.com/PestInfo/db/h/hot_canada.asp. The loose sequence of events upon execution is as follows: After CANADA.EXE is executed, it pops up a dialog that displays a pornographic image and asks the user if they would like to go to a porn site. Meanwhile, behind the scenes... It downloads HOT_CANADA.EXE from either 208.192.120.56 and 204.177.92.205 (via HTTP/port 80). HOT_CANADA.EXE is placed in a very obvious "dialers" folder under Program Files. HOT_CANADA.EXE then begins execution. It contacts 204.177.92.204 (via HTTP/port 80) and proceeds to download HOT_CANADAUPDATE.EXE which is placed in the root directory of the PC. HOT_CANADAUPDATE.EXE then takes over with the most interesting activity and downloads HotOrgy_ca.exe and HardcoreVideos_ca.exe. They are placed in their own directories under the now infamous "dialers" directory. Links are placed on the desktop and start menu to these new files. HOT_CANADA.EXE at this point seems to go into an idle state and this is where my experiments stopped. The outbound traffic was minimal and consisted of HTTP requests. HOT_CANADA.EXE did examine the registry entries for RAS, long distance dialing codes, and analog modem devices. This looks like a genuine "dialer" program. Although CANADA.EXE appeared to be "compacted" with PECompact, there appeared to be no serious effort to hide or obfuscate what this program and its supporting executables do. My window of testing was very short, so there may be more unsolicited action later on down the execution path. Naturally, it should not be assumed this program or programs like it are harmless based on what I have said. The should be considered a real threat, because this program had full access to my machine and the data contained within while it was executing. By the way, the IPs belong to a company called Lexitrans. Regards, John Herndon Security Consultant -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) - WinPT 0.7.94 iD8DBQE+cA1vPAH04z2c9bARArqrAJ4sTIarily9j6SH/s+NNboDgqOSkwCfZZYJ lOj/jIuIwYEZXrSeSPn9EIY= =pitm -----END PGP SIGNATURE----- ---------------------------------------------------------------------------- <Pre>Lose another weekend managing your IDS? Take back your personal time. 15-day free trial of StillSecure Border Guard.</Pre> <A href="http://www.securityfocus.com/stillsecure"> http://www.securityfocus.com/stillsecure </A>
This archive was generated by hypermail 2b30 : Thu Mar 13 2003 - 07:55:32 PST