Troj/Winser-A malware analysis

[Steve Friedl <steve () unixwiz net>]

Hello again, all,

Several days ago, Lawrence Baldwin of myNetWatchman.com captured the
WINS exploit Trojan that's running around the internet right now, and
I've been digging in with some gusto. It's not really a worm, but it
does have an "autohack" mode and a botnet capability, so it's something 
that probably deserves some attention.

Sophos has called this "Troj/Winser-A", but I have not seen any other
real analysis anywhere (including on the INCIDENTS list), so I'm posting
my work here. The analysis, including the binaries themselves, are at:

        Analysis of the Troj/Winser-A Malware
        http://www.unixwiz.net/research/winser-a.html

I am still pretty early in the process of the big Trojan - a colleague
who knows a bit about "the dark side" of IRC doesn't recognize it -
and anybody who wants my IDA Pro .idb files for analysis can have them
for the asking.

I'll update my page as I find more information.

Steve

-- 
Stephen J Friedl | Security Consultant |  UNIX Wizard  |   +1 714 544-6561
www.unixwiz.net  | Tustin, Calif. USA  | Microsoft MVP | steve () unixwiz net