Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Sponsored by: █ Sparkhost - Hosting Without Compromises! █ Hybrid Performance Web Hosting █ Spark Host Stream Hosting █ Hybrid IRC & IRCd Server Shell Accounts

UD Poison Ivy Server

Started by Ryan M , Jul 18 2008 02:31 AM

This topic is locked

14 replies to this topic

#1 Ryan M

First Sergeant

Second Lieutenant
1,740 posts

Posted 18 July 2008 - 02:31 AM

Bored, playing with new UD methods. Knock yourself out kiddies... (port 444) Injects into iexplorer.exe.

File Info

Report generated: 19.7.2008
Filename: server.exe
File size: 956 kb
PEiD: PEncrypt 3.1 Final -> junkcode [Overlay]
MD5 Hash: E2C2BEA0C07397F35111E6777DC01231
SHA1 Hash: EE01CE59FDE9785636E29B2665F1C783E2C33F65

Detections

A-Squared - Nothing found!
Antivir - Is the Trojan horse TR/Dropper.Gen
Avast - Nothing found!
AVG - Trojan horse BackDoor.PoisonIvy.AD
BitDefender - Nothing found!
ClamWin - Nothing found!
Comodo - Nothing found!
Dr.Web - Nothing found!
Ewido - Nothing found!
F-PROT 6 - Nothing found!
G DATA - Nothing found!
IkarusT3 - Nothing found!
Kaspersky - Nothing found!
McAfee - Nothing found!
Nod32 - Nothing found!
Norman - Nothing found!
Panda - Nothing found!
Sophos - Nothing found!
TrendMicro - Nothing found!
VBA32 - Nothing found!
Virus Buster - Nothing found!

Scan report generated by
NoVirusThanks.org

Attached Files

server.rar 498.72K 227 downloads

There is no security on this earth. Only opportunity.
-Douglas MacArthur
GSO Compiled Exploit Database
----------------------------------------
[b]Mod at GovernmentSecurity

Back to top

#2 Hackman

Private

Members
3 posts

Posted 22 July 2008 - 03:48 AM

what we can do with only server :blink:

Back to top

#3 No Dice

Retired GSO Second Lieutenant

Sergeant Major
723 posts

Posted 22 July 2008 - 05:31 AM

Download PI2 from the authors website and use port 444.

Back to top

#4 mygb

Private

Members
4 posts

Posted 22 July 2008 - 03:53 PM

Download PI2 from the authors website and use port 444.

how can we change the DNS this thing connects to??

Back to top

#5 webdevil

Retired GSO General

Sergeant Major
1,195 posts

Posted 22 July 2008 - 05:01 PM

Using an hex editor should help unless...

http://twitter.com/w3bd3vil

Back to top

#6 Ryan M

First Sergeant

Second Lieutenant
1,740 posts

Posted 22 July 2008 - 07:51 PM

I set it up to connect to local computer. Just forward the ports. You won't be able to download anyway as you are a trial member.

There is no security on this earth. Only opportunity.
-Douglas MacArthur
GSO Compiled Exploit Database
----------------------------------------
[b]Mod at GovernmentSecurity

Back to top

#7 mygb

Private

Members
4 posts

Posted 23 July 2008 - 04:48 PM

I set it up to connect to local computer. Just forward the ports. You won't be able to download anyway as you are a trial member.

sorry but i still dont understand this....if it connects to 127.0.0.1. how will it notify me once another computer has run it?

Back to top

#8 Guest_Dennis_*

Guests

Posted 31 July 2008 - 11:40 PM

It doesn't, he did not configure that, like Ryan answered above.

Back to top

#9 galex72

Private

Members
19 posts

Posted 01 August 2008 - 04:48 AM

Nod32 2.7 detect it:

probably a variant of Win32/Statik application

y0

Back to top

#10 fearstriker2

Private First Class

Members
20 posts

Posted 02 August 2008 - 05:08 AM

Get Poison Ivy from

hxxp://www.poisonivy-rat.com/

Back to top

#11 hyeclass

Private

Members
3 posts

Posted 18 December 2008 - 01:10 PM

ooohh nice site cant believe i didn't know this one.......

novirusthanks.org

Edit Edu : it is not nice to bump old threads to post pointless things...u already have a warning point, please review the forum rules

Back to top

#12 Edu

General

Members
2,268 posts

Posted 18 December 2008 - 02:43 PM

as this thread is old and the file should be detected by any AV by now, I think no point in letting it opened, it will just serve as a mean for useless posts like "oh nice thing...why cant I download....AVs detect it people dont download".

http://www.secumania.net - Secumania security blog.

Embed any executable in a JPEG image and get it to run upon opening the image with this cool tool that abuses a feature of GDI in Windows systems. for governmentsecurity.org members only! click here to get it!

Back to top

#13 Ryan M

First Sergeant

Second Lieutenant
1,740 posts

Posted 19 December 2008 - 01:29 AM

Lol @ New Scan

A-Squared  Found nothing 
AntiVir  Found TR/Dropper.Gen  
ArcaVir  Found nothing 
Avast  Found nothing 
AVG Antivirus  Found BackDoor.PoisonIvy.N  
BitDefender  Found nothing 
ClamAV  Found nothing 
CPsecure  Found nothing 
Dr.Web  Found nothing 
F-Prot Antivirus  Found nothing 
F-Secure Anti-Virus  Found nothing 
G DATA  Found nothing 
Ikarus  Found Trojan-Dropper  
Kaspersky Anti-Virus  Found nothing 
NOD32  Found nothing 
Norman Virus Control  Found W32/Suspicious_P.gen  
Panda Antivirus  Found nothing 
Sophos Antivirus  Found Sus/UnkPacker (probable variant)  
VirusBuster  Found nothing 
VBA32  Found nothing

BTW, this would be pointless to download to anyone. You need to config PI on your own computer. This is just seeing what packers/crypters can be used together.

There is no security on this earth. Only opportunity.
-Douglas MacArthur
GSO Compiled Exploit Database
----------------------------------------
[b]Mod at GovernmentSecurity

Back to top

#14 Edu

General

Members
2,268 posts

Posted 22 December 2008 - 03:16 PM

Lol @ New Scan

BTW, this would be pointless to download to anyone. You need to config PI on your own computer. This is just seeing what packers/crypters can be used together.

holly god...lol...I was wrong :blink:

not detected by a lot of AVs...good call buddy :lol:

http://www.secumania.net - Secumania security blog.

Embed any executable in a JPEG image and get it to run upon opening the image with this cool tool that abuses a feature of GDI in Windows systems. for governmentsecurity.org members only! click here to get it!

Back to top

#15 Ryan M

First Sergeant

Second Lieutenant
1,740 posts

Posted 28 December 2008 - 08:43 AM

The size is huge, I re-did it and it was super tiny

There is no security on this earth. Only opportunity.
-Douglas MacArthur
GSO Compiled Exploit Database
----------------------------------------
[b]Mod at GovernmentSecurity