Broadband Tech > Security > Security > [Hacked] DarkMailer?

reply to Snowy

Re: [Hacked] DarkMailer?

reply to major marco
Does anyone know how the guy was able to do a file transfer? As far as I know, VNC doesn't have a built-in file transfer feature. So I'm wondering how he got that onto her My Documents folder.
--
My Webmaster Gig | Crunching the Midnight Oil

ftp ? or http. once he has the desktop he is you.

reply to elias
I'm still wondering why AV's etc didn't detect it, unless it was a new/different version/nasty ! As there are more details about several others having knowledge + detection etc here -

dm.exe

Nov 2001 - »forums.windrivers.com/archive/in···255.html

Aug 2005 - darkmailer.exe - »fileinfo.prevx.com/filesearch.asp

March 2006 - »www3.ca.com/securityadvisor/pest···53097812

May 2006 - darkmailer - 390 Unique Executables Have Been Seen To Use The FileName: dm.exe since Jul 15 2005 The executables displayed below, have at some point, all been seen to use this name. They are shown along with their most commonly used file name and location. -»fileinfo.prevx.com/filesearch.asp

Who has that file that was uploaded to Jottis ?

Spanner
--
I Only Know What I Know, But I'm Learning all The Time - Stay Safe - Spanner intheWorks
/SpannerITWks

reply to elias
Have you checked to see if any other files have been deposited by the visitor ?

reply to SpannerITWks

Event Type:Error
Event Source:Symantec AntiVirus
Event Category:None
Event ID:46
Date:6/21/2006
Time:1:46:45 PM
User:N/A
Computer:SYLVIA
Description:

Security Risk Found!Threat: Trojan Horse in File: C:\DOCUME~1\Sylvi\MYDOCU~1\DM119P~1\DM.exe by: Auto-Protect scan.  Action: Quarantine succeeded.  Action Description: The file was quarantined successfully.

Event Type:Error
Event Source:Symantec AntiVirus
Event Category:None
Event ID:5
Date:6/21/2006
Time:1:46:45 PM
User:N/A
Computer:SYLVIA
Description:

Threat Found!Threat: Trojan Horse in File: C:\Documents and Settings\Sylvi\My Documents\dm119pro-v2\DM.exe by: Auto-Protect scan.  Action: Quarantine succeeded : Access denied.  Action Description: The file was quarantined successfully.

Event Type:Error
Event Source:Symantec AntiVirus
Event Category:None
Event ID:51
Date:6/21/2006
Time:1:46:49 PM
User:N/A
Computer:SYLVIA
Description:

Security Risk Found!Threat: Trojan Horse in File: C:\DOCUME~1\Sylvi\MYDOCU~1\DM119P~1\DM.exe by: Auto-Protect scan.  Action: Quarantine succeeded : Access denied.  Action Description: The file was quarantined successfully.

Event Type:Information
Event Source:WinVNC4
Event Category:None
Event ID:1
Date:6/21/2006
Time:10:17:42 AM
User:N/A
Computer:SYLVIA
Description:
Connections: accepted: 72.57.57.234::61898 

Event Type:Information
Event Source:WinVNC4
Event Category:None
Event ID:1
Date:6/21/2006
Time:10:17:44 AM
User:N/A
Computer:SYLVIA
Description:
Connections: closed: 72.57.57.234::61898 (Clean disconnection)  

Event Type:Information
Event Source:WinVNC4
Event Category:None
Event ID:1
Date:6/21/2006
Time:1:43:37 PM
User:N/A
Computer:SYLVIA
Description:
Connections: accepted: 172.168.216.89::3098  

Here is the IP Address Information and WHOIS for the two IPs that connected. One is from Rogers Cable (Canada) and the other is from AOL (could be a compromised AOL account).

elias

Hows the clean up going, good i hope !

Do you have a copy of dm.exe or any other files linked with it, could you Zip/Rar em + send it/them to me via a - »rapidshare.de/ - link ?

Thanx

Spanner
--
I Only Know What I Know, But I'm Learning all The Time - Stay Safe - Spanner intheWorks
/SpannerITWks

reply to elias
Further to our convos + receiving your file etc, i've had some more time to look @ the - dm119pro - file = SpamBot nasty.

It's a Phish on the SunTrust Bank which sends out tons of emails to numerous Addys in there, which get passed on + on. Amongst other things included in there is a Russian send to email Addy - aligatorx@k.ro - This is what i've discovered about the Phish email.

-

Dear SunTrust Bank Member,

Our security maintanance system indicates that your SunTrust banking account must be validated. We do that on regulary basis to keep your account up-to-date. If you received this notice and you are not the authorized account holder and you find account validation as an error, disregard the message or contact us at validation@www.suntrust.com . However,if you are the rightfull holder of the account, click on the link below,fill the form and then submit as we try to verify your identity.

https: //206.32.152.67/?internetBanking?RequestRouter?requestCmdId?DisplayLoginPage = ( DEAD LINK + not much whois )

https: //mysolutions.suntrust.com/authfiles/login.asp = ( APPEARS VALID )

SunTrust Bank is committed to assist law enforcement with any inquires related to attempts to misappropriate personal information with the intent to commit fraud or theft. Information will be provided at the request of law enforcement agencies to ensure that perpetrators are prosecuted to the fullest extent of the law. Thanks for your patience as we work together to protect your account.

Regards,

SunTrust Bank Security Department.

-

Spanner
--
I Only Know What I Know, But I'm Learning all The Time - Stay Safe - Spanner intheWorks
/SpannerITWks

Yes, I had noticed the txt file with the HTML for the above message. I believe it was being delivered to AOL users whos addresses started with the letter L.
--
My Webmaster Gig | Crunching the Midnight Oil