Hacker Tool Targeting MS08-067 Vulnerability

[SysAdMini]

http://securitylabs.websense.com/content/Blogs/3237.aspx

[tjs]

Anyone seen it in the wild?

[sowhat-x]

It's quite easy to get a copy of it...it's spread over at various chinese skiddie-haxor boards...

http://www.threatexpert.com/report.aspx?md5=eda4f634c84b8e06235b5024d72f012e
http://www.virustotal.com/analisis/4692ac80711ebf6e25b9331e7f863276

====================================================
My guess is that there are TOO many idiots/skiddies with plenty of free time out there,
that even though the above "tool" IS PROVEN to be backdoored itself,
still,they might attempt running it in order to abuse workstations out there...

So,I thought it's probably wiser to not repost the sample in question directly.
Individual malware researchers/analysts,
already have way more than enough info in order to grab the sample in question...

[SysAdMini]

So,I thought it's probably wiser to not repost the sample in question directly.
Individual malware researchers/analysts,
already have way more than enough info in order to grab the sample in question...

Wise decision.

[tjs]

totally understandable.

[SysAdMini]

MS08-067 Vulnerability: Botnets Reloaded
http://blog.trendmicro.com/ms08-067-vulnerability-botnets-reloaded/

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_DOWNAD.A&VSect=T

complete url of the threat is

Code: [Select]

hxxp://trafficconverter.biz/4vir/antispyware/loadadv.exe