EXP/MS08-067.C - Exploit

See also

Summary

Full description

Statistics

Virus:	EXP/MS08-067.C
Date discovered:	11/11/2008
Type:	Exploit
In the wild:	Yes
Reported Infections:	Low to medium
Distribution Potential:	Low
Damage Potential:	Medium
Static file:	No
File size:	~ 19.533 Bytes
IVDF version:	7.01.00.66 - Tue, 11 Nov 2008 07:33 (GMT+1)

General Method of propagation:
   • No own spreading routine

Aliases:
   • Symantec: Downloader
   • Kaspersky: Trojan-Downloader.Win32.Agent.aoxg
   • TrendMicro: TROJ_MAXIMUS.AO
   • F-Secure: Trojan-Downloader.Win32.Agent.aoxg
   • Sophos: Exp/MS08067-A
   • Grisoft: Agent.ALNC
   • Eset: Win32/Exploit.MS08-067.A
   • Bitdefender: Exploit.MS08-067.D

Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Downloads a malicious file
   • Drops a malicious file
   • Makes use of software vulnerability

Files The following file is created:

– %TEMPDIR%\suchots.exe Furthermore it gets executed after it was fully created. Further investigation pointed out that this file is malware, too. Detected as: TR/Expl.IMG-WMF.EX.2

It tries to download a file:

– The location is the following:
• http://down.yznylsf.cn/**********/ko.exe
It is saved on the local hard drive under: %malware execution directory%\ko.exe Furthermore this file gets executed after it was fully downloaded. Further investigation pointed out that this file is malware, too. Detected as: TR/Crypt.XDR.Gen

File details Programming language:
The malware program was written in MS Visual C++.

Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
• FSG

See a brief description here.

Description inserted by Thomas Wegele on Wed, 19 Nov 2008 14:39 (GMT+1)
Description updated by Thomas Wegele on Wed, 19 Nov 2008 14:53 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back