CANADA.EXE Findings

[John H <surfcityjohn () yahoo com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


All:

CANADA.EXE (aka HOT CANADA) is a "dialer" by nature.  In fact, a
known dialer:
http://www.pestpatrol.com/PestInfo/db/h/hot_canada.asp.

The loose sequence of events upon execution is as follows:

After CANADA.EXE is executed, it pops up a dialog that displays a
pornographic image and asks the user if they would like to go to a
porn site.

Meanwhile, behind the scenes...

It downloads HOT_CANADA.EXE from either 208.192.120.56 and
204.177.92.205 (via HTTP/port 80).  HOT_CANADA.EXE is placed in a
very obvious "dialers" folder under Program Files.

HOT_CANADA.EXE then begins execution.

It contacts 204.177.92.204 (via HTTP/port 80) and proceeds to
download HOT_CANADAUPDATE.EXE which is placed in the root directory
of the PC.

HOT_CANADAUPDATE.EXE then takes over with the most interesting
activity and downloads HotOrgy_ca.exe and HardcoreVideos_ca.exe. 
They are placed in their own directories under the now infamous
"dialers" directory.  Links are placed on the desktop and start menu
to these new files.

HOT_CANADA.EXE at this point seems to go into an idle state and this
is where my experiments stopped.  The outbound traffic was minimal
and consisted of HTTP requests.  HOT_CANADA.EXE did examine the
registry entries for RAS, long distance dialing codes, and analog
modem devices.

This looks like a genuine "dialer" program.  Although CANADA.EXE
appeared to be "compacted" with PECompact, there appeared to be no
serious effort to hide or obfuscate what this program and its
supporting executables do.  My window of testing was very short, so
there may be more unsolicited action later on down the execution
path.  Naturally, it should not be assumed this program or programs
like it are harmless based on what I have said.  The should be
considered a real threat, because this program had full access to my
machine and the data contained within while it was executing.

By the way, the IPs belong to a company called Lexitrans.

Regards,

John Herndon
Security Consultant

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32) - WinPT 0.7.94

iD8DBQE+cA1vPAH04z2c9bARArqrAJ4sTIarily9j6SH/s+NNboDgqOSkwCfZZYJ
lOj/jIuIwYEZXrSeSPn9EIY=
=pitm
-----END PGP SIGNATURE-----



----------------------------------------------------------------------------

<Pre>Lose another weekend managing your IDS?
Take back your personal time.
15-day free trial of StillSecure Border Guard.</Pre>
<A href="http://www.securityfocus.com/stillsecure";> http://www.securityfocus.com/stillsecure </A>