[9952] in bugtraq
Promail trojan
daemon@ATHENA.MIT.EDU (Patrick Oonk)
Fri Mar 19 17:43:20 1999
Date: Fri, 19 Mar 1999 22:40:30 +0100
Reply-To: patrick@pine.nl
From: Patrick Oonk <patrick@PINE.NL>
To: BUGTRAQ@NETSPACE.ORG
http://cool.icestorm.net/aeon/news.html
News and security advisories from Aeon Labs.
[03.99]
ProMail v1.21, an advanced freeware mail program for Windows 95/98, is a
trojan.
It has been spread through several worldwide distribution networks
(SimTel.net, Shareware.com and others) as proml121.zip.
Upon discovering - through LAN sniffing - that the program would attempt
to connect to SMTP instead of POP3 when a regular mail check was
performed, we reverse-engineered the software.
The executable, which appears to have been created with Borland Delphi,
has been packed with Petite (a shareware Win32-EXE compressor) and then
"hexed" to make disassembly harder.
ProMail v1.21 supports multiple mailboxes; every time a new mailbox is
created, an "ini" file containing the users full name, passwords, email
addresses, servers and more is generated.
Prior to doing any other action, the program performs a check for a
valid network connection which, if found, allows for the sending of ALL
of the personal user data, including the user's password in encrypted
format, to an account on NetAddress - a free email provider.
Apart from this "feature", the software is 100 % functional and very
well done.
For further information or a more detailed analysis contact us.
--
: Patrick Oonk - http://patrick.mypage.org/ - patrick@pine.nl :
: Pine Internet B.V. Consultancy, installatie en beheer :
: Tel: +31-70-3111010 - Fax: +31-70-3111011 - http://www.pine.nl/ :
: -- Pine Security Digest - http://security.pine.nl/ (Dutch) ---- :
: "unix is voor types zonder sociaal leven..." - Patrick van Eijk :
