[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Full-Disclosure] Quick Analysis of Netsky-B
- To: <full-disclosure@lists.netsys.com>
- Subject: [Full-Disclosure] Quick Analysis of Netsky-B
- From: "Helmut Hauser" <helmut_hauser@hotmail.com>
- Date: Thu, 19 Feb 2004 16:26:50 +0100
The Viruswriter seems to be from Germany
The string skynet@skynet.de
AdmSkynetJklS003
can be found inside the virus code
the IP 217.5.100.1 is a dial up from the german Telekom: DTAG-DIAL13
one of the attatchment names refers to a german explicit "movie star"
Nothing new as I can see, packed with upx, UDP packet sender, SMTP Routine,
tries to install itself as a service, tries to infect network shares and
file sharing ... business as usual.
the only not so harmless function is: Kernel32.DeleteFilaA
Helmut
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html