xcdegasp
29-11-2009, 12:10
Proprio oggi ho ricevuto la richiesta di autorizzazione dal classico spambot ma anzicchè inviare pubblicità il suo intendo era inviare un bel virus camuffato da archivio jar
la richiesta era la seguente:
470446528 vuole aggiungere 107222167 alla sua lista dei contatti: Privet eto Olenka xo4y seksa
vot glan moa fotka
h..p://image.slidexxx.cn/foto.jpg
http://img69.imageshack.us/img69/1475/listacontatti.png (http://img69.imageshack.us/i/listacontatti.png/)
Ovviamente il link porta a scaricare un bel virus che ancora gode il privilegio d'essere poco riconosciuto:
http://img690.imageshack.us/img690/9426/aperturadifotojar.png (http://img690.imageshack.us/i/aperturadifotojar.png/)
Risultato: 17/41 (41.47%)
http://img130.imageshack.us/img130/1592/virsutotal.png (http://img130.imageshack.us/i/virsutotal.png/)
http://www.virustotal.com/it/analisis/42c16a4e647b2cc849e2e72f18e3dae4782b67a050195453093203fbef629fbb-1259491062
Scanner results : 43% Scanner(s) (16/37) found malware!
http://virscan.org/report/d9e71cce90163733bc40e1722f4a1414.html
ThreatExpert lo identifica come Altamente Rischioso (livello 10) http://www.threatexpert.com/resources/level10.gif Trojan Horse [Symantec]
Trojan-SMS.J2ME.Agent.d [Kaspersky Lab]
di seguito il link per poter visionare il report dell'analisi:
http://www.threatexpert.com/report.aspx?md5=435ac8c739974f7824dc439c05cd5e89
Aggiornamento:
Il trojan è stato confezionato e sviluppato per colpire i cellulari e palmari che possono installare le applicazioni java come dichiara l'analisi svolta dai laboratori kaspersky il 24/07/2009:
link tradotto da russo a italiano -> http://babelfish.yahoo.com/translate_url?doit=done&tt=url&intl=1&fr=bf-home&trurl=http%3A%2F%2Fwww.securelist.com%2Fru%2Fdescriptions%2F12322891%2FTrojan-SMS.J2ME.Agent.d&lp=ru_en&btnTrUrl=Translate
link originale -> http://www.securelist.com/ru/descriptions/12322891/Trojan-SMS.J2ME.Agent.d
The technical details
Trojan program, which damages the cell phones of any producers, which use Java (J2ME). Are achieved attempts at the not sanctioned by user dispatch of SMS- communications from the infected mobile devices to the paid [premium]- numbers.
Destructive activity
Is the application Of java - archive in the size JAR. File has a name of foto.jar. The size of file can vary in the limits from 68386 to 68434 bytes.
Archive includes the following files:
# inf.dat - auxiliary file (115 bytes);
# icon.png - [ikonka] of appendix (1477 bytes);
# 1.png - file of image (7156 bytes);
# 2.png - file of image (30706 bytes);
# 3.png - file of image (19725 bytes);
# a.class - auxiliary file (1058 bytes);
# b.class - auxiliary file (2634 bytes);
# c.class - harmful file, which achieves an attempt at the sending of SMS- communications (3171 bytes);
# d.class - auxiliary file (5601 byte);
# e.class - auxiliary file (300 bytes);
# f.class - auxiliary file (3365 bytes);
# midlet.class - auxiliary file (1071 byte).
Trojan is extended with the aid of the distribution of [spama] in ICQ. Text to [spam] of communication can take the following form:
“[Privetik] to me friend did give [tvoyyu] to [fotku] here cast a look this you or not? and that to me it was strongly pleased) "
Application is established on the telephone by the name “of foto”. The following image is reflected after the starting of program on the screen of telephone:
http://www.securelist.com/ru/images/vlill/agent.d.1.png
Which through several seconds is changed to this picture:
http://www.securelist.com/ru/images/vlill/agent.d.2.png
After which the following is reflected on the screen:
http://www.securelist.com/ru/images/vlill/agent.d.3.png
If user presses “to increase”, then program attempts to send SMS- communication with the specific text to one of the short numbers: 8355 (cost of one SMS - 4 US dollars or ~110 of rubles); 7122 (cost of one SMS - 9 US dollars or ~250 of rubles); or 7132 (cost of one SMS - 6 US dollars or ~180 of rubles).
Recommendations regarding the removal
1. If program was established on the common telephone, then users can move away by its standard means.
2. If program was established on [smartfone], then, besides the standard means of removal, users can use Kaspersky Of mobile Of security with the renovated bases for the removal of harmful file.
la richiesta era la seguente:
470446528 vuole aggiungere 107222167 alla sua lista dei contatti: Privet eto Olenka xo4y seksa
vot glan moa fotka
h..p://image.slidexxx.cn/foto.jpg
http://img69.imageshack.us/img69/1475/listacontatti.png (http://img69.imageshack.us/i/listacontatti.png/)
Ovviamente il link porta a scaricare un bel virus che ancora gode il privilegio d'essere poco riconosciuto:
http://img690.imageshack.us/img690/9426/aperturadifotojar.png (http://img690.imageshack.us/i/aperturadifotojar.png/)
Risultato: 17/41 (41.47%)
http://img130.imageshack.us/img130/1592/virsutotal.png (http://img130.imageshack.us/i/virsutotal.png/)
http://www.virustotal.com/it/analisis/42c16a4e647b2cc849e2e72f18e3dae4782b67a050195453093203fbef629fbb-1259491062
Scanner results : 43% Scanner(s) (16/37) found malware!
http://virscan.org/report/d9e71cce90163733bc40e1722f4a1414.html
ThreatExpert lo identifica come Altamente Rischioso (livello 10) http://www.threatexpert.com/resources/level10.gif Trojan Horse [Symantec]
Trojan-SMS.J2ME.Agent.d [Kaspersky Lab]
di seguito il link per poter visionare il report dell'analisi:
http://www.threatexpert.com/report.aspx?md5=435ac8c739974f7824dc439c05cd5e89
Aggiornamento:
Il trojan è stato confezionato e sviluppato per colpire i cellulari e palmari che possono installare le applicazioni java come dichiara l'analisi svolta dai laboratori kaspersky il 24/07/2009:
link tradotto da russo a italiano -> http://babelfish.yahoo.com/translate_url?doit=done&tt=url&intl=1&fr=bf-home&trurl=http%3A%2F%2Fwww.securelist.com%2Fru%2Fdescriptions%2F12322891%2FTrojan-SMS.J2ME.Agent.d&lp=ru_en&btnTrUrl=Translate
link originale -> http://www.securelist.com/ru/descriptions/12322891/Trojan-SMS.J2ME.Agent.d
The technical details
Trojan program, which damages the cell phones of any producers, which use Java (J2ME). Are achieved attempts at the not sanctioned by user dispatch of SMS- communications from the infected mobile devices to the paid [premium]- numbers.
Destructive activity
Is the application Of java - archive in the size JAR. File has a name of foto.jar. The size of file can vary in the limits from 68386 to 68434 bytes.
Archive includes the following files:
# inf.dat - auxiliary file (115 bytes);
# icon.png - [ikonka] of appendix (1477 bytes);
# 1.png - file of image (7156 bytes);
# 2.png - file of image (30706 bytes);
# 3.png - file of image (19725 bytes);
# a.class - auxiliary file (1058 bytes);
# b.class - auxiliary file (2634 bytes);
# c.class - harmful file, which achieves an attempt at the sending of SMS- communications (3171 bytes);
# d.class - auxiliary file (5601 byte);
# e.class - auxiliary file (300 bytes);
# f.class - auxiliary file (3365 bytes);
# midlet.class - auxiliary file (1071 byte).
Trojan is extended with the aid of the distribution of [spama] in ICQ. Text to [spam] of communication can take the following form:
“[Privetik] to me friend did give [tvoyyu] to [fotku] here cast a look this you or not? and that to me it was strongly pleased) "
Application is established on the telephone by the name “of foto”. The following image is reflected after the starting of program on the screen of telephone:
http://www.securelist.com/ru/images/vlill/agent.d.1.png
Which through several seconds is changed to this picture:
http://www.securelist.com/ru/images/vlill/agent.d.2.png
After which the following is reflected on the screen:
http://www.securelist.com/ru/images/vlill/agent.d.3.png
If user presses “to increase”, then program attempts to send SMS- communication with the specific text to one of the short numbers: 8355 (cost of one SMS - 4 US dollars or ~110 of rubles); 7122 (cost of one SMS - 9 US dollars or ~250 of rubles); or 7132 (cost of one SMS - 6 US dollars or ~180 of rubles).
Recommendations regarding the removal
1. If program was established on the common telephone, then users can move away by its standard means.
2. If program was established on [smartfone], then, besides the standard means of removal, users can use Kaspersky Of mobile Of security with the renovated bases for the removal of harmful file.