Re: Backdoor, Virus, Dialer? More information.

[Michael Renzmann <security () dylanic de>]

Hi all.

Valdis.Kletnieks () vt edu wrote:
> > Recently I received some mails in english language. The writer (who 
> > pretends being security () microsoft com, but the header says "Sender: 
> > admin () duma gov ru") generously sends a patch along with his mail which 
> > should be applied in order to fix a security bug... ha ha.
> Most likely a known virus, W32/Dumaru-A.   If what you have there *doesnt*
> match that one, give us another buzz....

As Vladis pointed out, the mail seems to be result of a 
W32/Dumaru@mm-variant. Another fd-reader pointed to W32/Dumaru.B@mm as well.

Symantec currently lists two variants of W32/Dumaru:

1. W32/Dumaru@mm, having an attachment with 9216 bytes
2. W32/Dumaru.b@mm, having an attachment with 34304 bytes

However, the mails I received (at least five of them) have an attachment 
with 9276 byte. Either Symantec has a typo at their site, or this could 
be a new variant.

As there were many people asking me to send them the binary, I decided 
to put the file and a copy of the mail on my webserver. To be found at 
http://www.otaku42.de/download/dumaru/index.html

Bye, Mike

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html