Data on a sample of a suspected new malware being spread via SMB.
This was caught by my WormCharmer.
I have included data on a sample of the dropper and the files extracted from the
RAR SFX dropper for your information and analysis.
4 copies have been trapped so far.
I haven’t had a chance to test it on a goat system yet.
============================================================
Details:
FileName: jarule.exe
FileDateTime: 17/02/2006 20:30:48
Filesize: 162658
MD5: ed889d9d147fae7ebee5e22cab354097
CRC32: E90E94A9
File Type: PE Executable RAR
Scan report of: jarule.exe
@Proventia-VPS -
AntiVir -
Avast! Win32:SpyBot-A3042 [Trj]
AVG IRC/BackDoor.SdBot.XOZ (Trojan horse)
BitDefender Backdoor.SDBot.1F9B5E58
ClamAV Worm.Mytob.GH
Command -
Dr Web Win32.IRC.Bot.based
eSafe -
eTrust-INO -
eTrust-INO (BETA) -
eTrust-VET -
eTrust-VET (BETA) -
Ewido -
F-Prot -
F-Secure Trojan-Proxy.Win32.Ranky.ei
F-Secure (BETA) Trojan-Proxy.Win32.Ranky.ei
Fortinet W32/Ranky.EI!tr
Fortinet (BETA) W32/Ranky.EI!tr
Ikarus -
Kaspersky Backdoor.Win32.SdBot.gen
McAfee New Malware.r (trojan or variant)
McAfee (BETA) New Malware.r (trojan or variant)
Nod32 -
Norman -
Panda Bck/Sdbot.GGX
Panda (BETA) Bck/Sdbot.GGX
QuickHeal -
Sophos -
Symantec Trojan.Dropper
Symantec (BETA) Trojan.Dropper
Trend Micro -
Trend Micro (BETA) TROJ_DROPPER.ALA
VBA32 Trojan-Spy.Banker.24 (suspected)
VirusBuster Worm.DR.SdBot.BUS
YY_Spybot -
============================================================
Drops:-
============================================================
FileName: creah.exe
FileDateTime: 14/02/2006 13:59:01
Filesize: 35379
MD5: 19bbd0cc234f256b946210946e2db934
CRC32: A886F494
File Type: PE Executable
Scan report of: creah.exe
@Proventia-VPS Malicious (Cancelled)
AntiVir PCK/MEW
Avast! -
AVG IRC/BackDoor.SdBot.XOZ (Trojan horse)
BitDefender Backdoor.SDBot.1F9B5E58
ClamAV Worm.Mytob.GH
Command -
Dr Web Win32.IRC.Bot.based
eSafe Trojan/Worm [100] (suspicious)
eTrust-INO Win32/IRCBot.Variant!Trojan
eTrust-INO (BETA) Win32/IRCBot.Variant!Trojan
eTrust-VET -
eTrust-VET (BETA) -
Ewido -
F-Prot -
F-Secure Backdoor.Win32.SdBot.gen
F-Secure (BETA) Backdoor.Win32.SdBot.gen
Fortinet W32/SDBot!bdr
Fortinet (BETA) W32/SDBot!bdr
Ikarus Backdoor.Win32.Rbot.Gen
Kaspersky Backdoor.Win32.SdBot.gen
McAfee -
McAfee (BETA) -
Nod32 IRC/SdBot trojan (variant)
Norman W32/Suspicious_M.gen
Panda Bck/Sdbot.GGX
Panda (BETA) Bck/Sdbot.GGX
QuickHeal W32.Bobic.L
Sophos W32/Sdbot-Fam
Symantec W32.Spybot.Worm
Symantec (BETA) W32.Spybot.Worm
Trend Micro WORM_SDBOT.DHB
Trend Micro (BETA) WORM_SDBOT.DHB
VBA32 Trojan-Spy.Banker.24 (suspected)
VirusBuster Worm.SdBot.BUS
YY_Spybot -
============================================================
FileName: creat.exe
FileDateTime: 14/02/2006 13:58:49
Filesize: 61440
MD5: 64abbfc626189f3101aabe09ddcfcb95
CRC32: 926A1144
File Type: PE Executable
Scan report of: creat.exe
@Proventia-VPS Malicious (Cancelled)
AntiVir TR/Proxy.Ranky.EI.1
Avast! Win32:SpyBot-A3042 [Trj]
AVG Packed.gen
BitDefender BehavesLike:Win32.Backdoor (suspected)
ClamAV -
Command -
Dr Web Trojan.NtRootKit.40
eSafe -
eTrust-INO -
eTrust-INO (BETA) -
eTrust-VET Win32/NTPacker.C
eTrust-VET (BETA) Win32/NTPacker.C
Ewido Backdoor.Bifrose.d
F-Prot -
F-Secure Trojan-Proxy.Win32.Ranky.ei
F-Secure (BETA) Trojan-Proxy.Win32.Ranky.ei
Fortinet W32/Ranck.DO!tr
Fortinet (BETA) W32/Ranck.DO!tr
Ikarus Backdoor.Win32.ProRat.B
Kaspersky Trojan-Proxy.Win32.Ranky.ei
McAfee New Malware.r (trojan or variant)
McAfee (BETA) New Malware.r (trojan or variant)
Nod32 Win32/TrojanDropper.ErPack trojan
Norman -
Panda -
Panda (BETA) -
QuickHeal -
Sophos Troj/Ranck-DO
Symantec Backdoor.Ranky
Symantec (BETA) Backdoor.Ranky
Trend Micro TROJ_RANKY.IH
Trend Micro (BETA) TROJ_RANKY.IH
VBA32 Malware.Delf.5 (suspected)
VirusBuster Trojan.PR.Ranck.HM
YY_Spybot -
============================================================
