what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

razor.wintrinoo.txt

razor.wintrinoo.txt
Posted Feb 29, 2000
Authored by Simple Nomad | Site razor.bindview.com

Razor has acquired a copy of the Windows Trojan Trinoo, the following is technical information gained from disassembling the binary.

tags | denial of service, trojan
systems | windows
SHA-256 | 5d0c0846d11849da11543b411218612346e6ce7fccec69dfcc03ec349a9e6dce

razor.wintrinoo.txt

Change Mirror Download

RAZOR has acquired a copy of the Trojan Trinoo. Here is a bit of
information about it. Sorry this isn't in official "advisory" style of
writing, but I really wanted to get this info out quickly.

The trojan is called service.exe, but could be renamed. It is 23145 bytes
in length. To remove it you must kill in in memory, remove its entry at
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run, and
delete the file from the hard drive. Make sure you delete the correct
file, and not services.exe.

It listens on udp port 34555, and will respond to pings on udp port 35555.
The password is "[]..Ks" (without the quotes). Therefore the following
will detect it:

Set up a netcat listener:
nc -u -n -l -p 35555 -v -w 100

Send a trinoo ping:
echo 'png []..Ks l44' | nc -u -n -v -w 3 192.168.1.5 34555

The listener will display PONG if a trinoo daemon is listening.

This will kill it:
echo 'd1e []..Ks l44' | nc -u -n -v -w 3 192.168.1.5 34555

After it is killed, the udp port may still be bound until a reboot, at
least on Windows 95/98. Subsequent trinoo pings will return an ICMP
destination unreachable/port unreachable if it is down.

I've updated the unix version of Zombie Zapper to reflect this. You can
download it from http://razor.bindview.com/tools/ZombieZapper_form.shtml,
look for the Unix version 1.1 with Trinoo Trojan support near the bottom
of the page. Hopefully we'll have a Unix version available sometime
Monday.

Both Seth McGann and Todd Sabin of RAZOR contributed heavily to the info
above after disassembling the trojan. And special thanks to Gary Flynn at
James Madison University for supplying RAZOR with a sample for testing.


- Simple Nomad - No rest for the Wicca'd -
- thegnome@nmrc.org - www.nmrc.org -
- thegnome@razor.bindview.com - razor.bindview.com -

Login or Register to add favorites

File Archive:

August 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    20 Files
  • 2
    Aug 2nd
    4 Files
  • 3
    Aug 3rd
    6 Files
  • 4
    Aug 4th
    55 Files
  • 5
    Aug 5th
    16 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    13 Files
  • 9
    Aug 9th
    13 Files
  • 10
    Aug 10th
    34 Files
  • 11
    Aug 11th
    16 Files
  • 12
    Aug 12th
    5 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    25 Files
  • 16
    Aug 16th
    3 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close