The Mega-D botnet that everyone was led to believe was so huge apparently isn't according to a recent blog post at asert.arbornetworks.com

SecureWorks: Ozdok/Mega-D Trojan Analysis

by Danny McPherson

Enabled by some spam samples Marshal provided, Joe Stewart and the good folks @SecureWorks, with an assist from Team Cymru and my|NetWatchman, have identified the malware and botnet referred to as Mega-D.

It turns out Mega-D is composed of bots from the little-known Ozdok malware family. Joe provides some analysis on scale and distribution of the botnet here, as well as some detailed bits on behaviors of the Trojan itself.

Based solely on the hostnames provided in the analysis we (Jose, actually) was able to find three samples in our database, with dates all well over a year old:

Read the full story at the link below.

http://asert.arbornetworks.com/2008/02/secureworks-ozdokmega-d-trojan-analysis/

video.exe - 9f36a92add503d6c08a97d5dc0d5eb8c

* name: video.exe
* size: 91831
* md5.: 9f36a92add503d6c08a97d5dc0d5eb8c


AntiVir 7.6.0.62/20080208 found [TR/Dropper.Gen]
eSafe 7.0.15.0/20080128 found [suspicious Trojan/Worm]
Ikarus T3.1.1.20/20080210 found [Trojan-Spy.Win32.Banker.caw]
Panda 9.0.0.4/20080209 found [Suspicious file]
VBA32 3.12.6.0/20080209 found [suspected of Trojan-IM.VB.1 (paranoid heuristics)]
Webwasher-Gateway 6.6.2/20080209 found [Trojan.Dropper.Gen]


packers: UPX_LZMA
AV's that added because of your submission:

Trojan-Downloader.Win32.Banload.hjl

album_leticia.exe - 532c3c5674bb03464d4d990c291d8a14

* name: album_leticia.exe
* size: 14794
* md5.: 532c3c5674bb03464d4d990c291d8a14


ClamAV 0.92/20080210 found [Trojan.Downloader-13210]
Rising 20.29.22.00/20080130 found [Trojan.DL.Win32.Agent.ejs]
Webwasher-Gateway 6.6.2/20080210 found [Virus.Win32.FileInfector.gen!90 (suspicious)]

AV's that added based on your submission:

Avira Lab: TR/Dldr.Agent.iwf
Kaspersky: Trojan-Downloader.Win32.Agent.iwf

elxxfghg.dll- 227f6af6fb4ae8063b5f7348fd9694ee

* name: elxxfghg.dll
* size: 80084 bytes
* md5.: 227f6af6fb4ae8063b5f7348fd9694ee


AntiVir 7.6.0.62/20080210 found [TR/Dldr.ConHook.Gen]
Avast 4.7.1098.0/20080210 found [Win32:TratBHO]
AVG 7.5.0.516/20080210 found [Lop]
BitDefender 7.2/20080210 found [Trojan.Vundo.DYM]
DrWeb 4.44.0.09170/20080210 found [Trojan.Virtumod.272]
eTrust-Vet 31.3.5522/20080208 found [Win32/Vundo.MO]
F-Prot 4.4.2.54/20080210 found [W32/Virtumonde.G.gen!Eldorado]
Ikarus T3.1.1.20/20080210 found [not-a-virus:AdWare.Win32.Virtumonde]
Kaspersky 7.0.0.125/20080210 found [not-a-virus:AdWare.Win32.Virtumonde.gen]
Microsoft 1.3204/20080210 found [Trojan:Win32/Vundo.gen!A]
Norman 5.80.02/20080208 found [W32/Virtumonde.KYQ]
Panda 9.0.0.4/20080210 found [Suspicious file]
Sophos 4.26.0/20080210 found [Troj/Virtum-Gen]
Symantec 10/20080210 found [Trojan.Adclicker]
TheHacker 6.2.9.215/20080209 found [Adware/Virtumonde.gen]
VirusBuster 4.3.26:9/20080210 found [Adware.Vundo.V.Gen]
Webwasher-Gateway 6.6.2/20080210 found [Trojan.Dldr.ConHook.Gen]

sbsm.exe - ead7b53b7a67d39dfe74ff6fe981d389

* size: 2759 bytes
* md5.: ead7b53b7a67d39dfe74ff6fe981d389

AVG 7.5.0.516/20080211 found [Downloader.Zlob]
F-Secure 6.70.13260.0/20080211 found [Trojan-Downloader.Win32.Zlob.hku]
Kaspersky 7.0.0.125/20080211 found [Trojan-Downloader.Win32.Zlob.hku]
NOD32v2 2865/20080211 found [Win32/TrojanDownloader.Zlob.BPH]
Prevx1 V2/20080211 found [Downloader.Zlob]
Symantec 10/20080211 found [Trojan.Startpage]
VirusBuster 4.3.26:9/20080211 found [Trojan.DL.Zlob.Gen.34]


Edit 1: Added by Ikarus as Virus.Win32.Zlob.AJV
Edit 2: Added by Avira as TR/Dldr.Zlob.hku
Edit 3: Added by DrWeb as Virus: Trojan.Popuper

New Nuwar

Yet another new set of Nuwar (storm worm) spam mails are coming out. Be on the look out for emails like the following:

Dear Customer,

Our robot has detected an abnormal activity from your IP adress
on sending e-mails. Probably it is connected with the last epidemic
of a worm which does not have official patches at the moment.

We recommend you to install this patch to remove worm files
and stop email sending, otherwise your account will be blocked.

Customer Support Robot

The downloaded executable is named "patch.exe"

****URLS BELOW ARE POSTED FOR RESEARCH PURPOSES ONLY VISIT AT YOUR OWN RISK****

Worm Detected!
Customer Support Center
nrp @ eyou.com
http:// 74.227.240.152/ ?a3b01bdad81d9b848ca9a8

Worm Activity Detected!
Customer Support
qof @ calgarypolice.ca
http:// 66.31.89.82/ ?2989907cd64e28cae3d7703a3b01bdad81d9b

Spyware Alert!
Customer Support Robot
vyjig @ kbhr933.com
http:// 203.192.225.72/ ?b161d496d2989907cd64e28cae3d7703a3b01bd

Spyware Detected!
Customer Support Robot
vyjig @ kbhr933.com
http:// 76.24.0.216/ ?8ee7c634591933434671c1

Trojan Alert!
Administrator
aupl @ nyc.rr.com
http:// 69.177.200.82/ ?1c8a8aa50bb1c20bb5790c08a823e9627257

Malware Alert!
Customer Support Robot
xas @ evercell.com
http:// 81.48.51.112/ ?8a823e96272575cbc68911e6c36a4bc9

Virus Activity Detected!
Mailer-Deamon
bij @ fibertel.com.ar
http:// 76.83.102.143/ ?8088aea28abd4d55393e4dd7ae5b23933

ATTN!
Customer Support Center Robot
gal @ madbrands.com
http:// 66.68.92.35/ ?e7c634591933434671c16a2e59b1283bd17061a

Worm Alert!
Administrator
djn @ lge.com
http:// 81.236.145.163/ ?58e47d14c775ed2175ee0c2a4c1c8a8aa50

****URLS ABOVE ARE POSTED FOR RESEARCH PURPOSES ONLY VISIT AT YOUR OWN RISK****

Microsoft Releases Early Patch for ANI Exploit

Today Microsoft broke from its normal update schedule to release a patch for the ANI exploit that was made public last week.

Spread the word and get your family, friends, and coworkers updated.

More about the patch can be found at the link below. http://www.microsoft.com/technet/security/bulletin/ms07-apr.mspx

Nice to see a patch pushed so fast!