Bunjee Love

[Ian Kenefick (Ireland)]

Pictures of me and my girlfriend having sex at the end of a Bunjee Rope 100 meters off a bridge in Scotland
http://bunjeelove.fsckme.net/BunjeeLove.zip

This above is another version of Hackarmy IRC backdoors...

Norman sandbox analysis...
Virus W32/Backdoor

[ General information ]
* File length: 20480 bytes.

[ Changes to filesystem ]
* Creates file C:\WINDOWS\SYSTEM\winXPupdate.exe.
* Deletes file C:\SAMPLE.EXE.

[ Changes to registry ]
* Creates value "Winsock32driver"="winXPupdate.exe" in key
"HKLM\Software\Microsoft\Windows\CurrentVersion\Run".

[ Network services ]
* Looks for an Internet connection.
* Connects to "eleven.afraid.org" on port 6667 (IP).
* Connects to IRC server.
* IRC: Uses nickname doeoeoeo.
* IRC: Uses username doeoeoeo.
* IRC: Joins channel ##11## with password grandad.

[ Process/window information ]
* Will automatically restart after boot (I'll be back...).
* Attemps to open C:\WINDOWS\SYSTEM\winXPupdate.exe qwerC:\SAMPLE.EXE.
* Creates a mutex fdsfsd.


Ian.

[Some Guy]

Pictures of me and my girlfriend having sex at the end of a Bunjee
Rope 100 meters off a bridge in Scotland
http://bunjeelove.fsckme.net/BunjeeLove.zip

Scanned file: BunjeeFucking.scr

BunjeeFucking.scr - packed with PECompact
BunjeeFucking.scr - infected by Backdoor.Hackarmy.gen

NNTP-Posting-Host: 24.66.94.143
X-Complaints-To: ***@shaw.ca
NNTP-Posting-Date: Sat, 25 Sep 2004 09:30:18 MDT
Organization: Shaw Residential Internet

[Miles Fromier]

Pictures of me and my girlfriend having sex at the end of a Bunjee
Rope 100 meters off a bridge in Scotland

I prefer my sex with no strings attached...

[Max Mustermann]

Post by Miles Fromier

Pictures of me and my girlfriend having sex at the end of a Bunjee
Rope 100 meters off a bridge in Scotland

I prefer my sex with no strings attached...

Strings are ok if they're not too tight.

The backdoor army thing bothers me though.