SV: New malware to infect IIS and from there jump to clients

["Peter Kruse" <kruse () krusesecurity dk>]

Hi Nick,

> It does this via the now very old ms-its: protocol zone-handling bug...
> Apparently someone needs to decode a few more levels of JavaScript, etc
> to work this all out...

I don´t think so. This looks a lot like the unpatched IE bug that was also
exploited by the Ilookup trojan. See http://62.131.86.111/analysis.htm.

> > Consider to deny access to http://217.107.218.147 in your firewall. This
> > will at least prevent client PCs from getting infected.
>
> Thanks Peter, but what about all the _other_ servers out there also
> hosting more or less exactly the same files?  Are you going to provide
> a list of all those IPs too?

Why should I? I think you should look at the code again, Nick.

When the javascript runs it will try to redirect you to a remote server
http://217.107.218.147. This is where the MSITS.EXE and the javascripts are
stored. As far as I know they do not reside on the compromised IIS servers,
but simply pulls of the the payload from the remote host. Meanwhile the host
is no longer available.

Regards
Peter Kruse

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html