Win32.Turkojan.jv
Also known as:
7b5a07d18d2ae6641db64cec28607da7
AntiVir TR/Spy.Agent.AHAB
AVG PSW.Delf
BitDefender GenPack:Trojan.Agent.AHAB
DrWeb BACKDOOR.Trojan
eSafe suspiciousTrojan/Worm
F-Prot W32/Threat-Backdoor-Silly-based!Maximus
F-Secure Turkojan.gen1
Ikarus Generic.Agent.AHAB
Kaspersky Backdoor.Win32.Turkojan.jv
Microsoft VirTool:Win32/DelfInject.gen!L
NOD32v2 Win32/Cakl.NAF
Norman Turkojan.gen1
Panda Suspiciousfile
Prevx1 Heuristic:Suspicious File With Mass Email Capabilities
Rising Trojan.Win32.Undef.dhp
Sophos Troj/Agent-GMF
VBA32 Backdoor.Win32.Turkojan.a
Webwasher-Gateway Trojan.Spy.Agent.AHAB
Packer UPX_LZMA
Very interesting control channel. High port, turkish ascii commands. All in the clear. Here's a sample interaction, connection initiated by the client:
ams
MINFOMINFO|AresCiler|192.168.1.30|HOME-LG9MLMX7MI|WinXP|ENU|
BAGLI
....BAGLI
BAGLANTI?
LOGS1
....LOGS1.[]
KEYL1
....KEYL1
UZMAS
(following all to server, keepalive?)
BAGLANTI?
BAGLANTI?
BAGLANTI?
BAGLANTI?
Drives
...Drives C: Fixed
D: CD-ROM
BROWSD:\
....metin
:
BROWSC:\
9...metin
FOUND.000
FOUND.001
Documents and Settings
Program Files
System Volume Information
Recycled
WINDOWS
CONFIG.SYS?0.--a-
AUTOEXEC.BAT?0.--a-
IO.SYS?0.rhas
MSDOS.SYS?0.rhas
ntdtcstp.dll?7168.--a-
cmsetac.dll?33280.--a-
PAGEFILE.SYS?201326592.-has
ntldr?250032.rhas
NTDETECT.COM?47564.rhas
boot.ini?194.-h-s
hiberfil.sys?268029952.-has
BAGLANTI?
BROWSC:\Program Files\
....metin
.
..
Common Files
Windows NT
MSN Gaming Zone
MSN
Messenger
Online Services
WindowsUpdate
ComPlus Applications
Internet Explorer
Outlook Express
NetMeeting
Windows Media Player
Movie Maker
microsoft frontpage
xerox
Uninstall Information
Java
:BAGLANTI?
BAGLANTI?
DISCNSHELL|DESACTIVARBAGLI
....BAGLI
BAGLANTI?
IMPWD
....PLUGNc:\twmsico.dll
ULFC:\Program Files\Turkojan\twmsico.dll|c:\
HAYDI
BAGLANTI?
BAGLANTI?
WLIST
....WLIST|
BAGLANTI?
WLIST
....WLIST|
WLIST
....WLIST|
WLIST
....WLIST|
WLIST
....WLIST|
BAGLANTI?
BAGLANTI?
UZMAS
BAGLANTI?
BAGLANTI?
BAGLANTI?
BAGLANTI?
BAGLANTI?
BAGLANTI?
BAGLANTI?
BAGLANTI?
BAGLANTI?
BAGLANTI?
BAGLANTI?
BAGLANTI?
Some translation help is here:
http://www.seslisozluk.com/?word=baglanti&go_seslisozluk_search=Search
Rather interesting one. First Turkish language C&C I recall seeing.
Sigs
2008021,
2008022,
2008023,
2008024,
2008025,
2008026,
2008027,
2008028.
2008029. and
2008030 should cover this well.
--
MattJonkman - 19 Mar 2008