Possible trojan help / mystery

[KaosDG]

OK, one of my users recieved the following e-mail:
(domains changed)


From: management@company.com [mailto:management@company.com]
Sent: Wednesday, March 03, 2004 10:38 AM
To: JM
Subject: Notify about your e-mail account utilization.


Hello user of company.com e-mail server,

Our main mailing server will be temporary unavaible for next two days,
to continue receiving mail in these days you have to configure our free
auto-forwarding service.

For details see the attached file.

Attached file protected with the password for security reasons. Password is 73611.

Cheers,
The Company.com team http://www.company.com


And there is an attachment, "TextDocument.zip" with the contents of one filem nyxanex.exe+


Searching my usual sources (Trend, SARC, McAffee, Google even) turns up no definitive results.

Google only turns up a mailing list, with a "similar" attachment (very different message): http://lists.w3.org/Archives/Public/www-ws-arch/2004Mar/attachment.html

What makes this message suspect (aside from the obvious) is that we control the mail servers, and we haven't sent anything out like this (we dont have a management mail alias)



Anyone have any ideas?

[XOR != OR]

Originally posted by KaosDG
Anyone have any ideas? Well, it sounds like an active attempt to zombie some boxes ( as apposed to the automated method, ala the latest and greatest virus ).

What I find interesting is the password protected zip file, which I assume is used to circumvent archive scanning on the server.

Just a guess tho. Has anybody else gotten one of these emails? Can you check the headers and see where they came from?

[KaosDG]

Originally posted by XOR != OR
Well, it sounds like an active attempt to zombie some boxes ( as apposed to the automated method, ala the latest and greatest virus ).

What I find interesting is the password protected zip file, which I assume is used to circumvent archive scanning on the server.

Just a guess tho. Has anybody else gotten one of these emails? Can you check the headers and see where they came from?


Actually the zip wasn't password protected :) Score one for the :tard:s :D

I'm tempted to run it or debugger it on my quarantine box, just for shits.

However, its time to go buy a guitar.

[Clanless]

Just got this in my emaill from the Corporate IT dept:

TO ALL USERS:



If you receive and email that states any of the following below PLEASE DELETE IMMEDIATELY:



From: (May be one of the following)
management@<recipient domain>
administration@<recipient domain>
staff@<recipient domain>
noreply@<recipient domain>
support@<recipient domain>

Subject: (One of the following)
E-mail account disabling warning.
E-mail account security warning.
Email account utilization warning.
Important notify about your e-mail account.
Notify about using the e-mail account.
Notify about your e-mail account utilization.
Warning about your e-mail account.

Message: (One of the following lines)
Dear user of <domain>,
Dear user of <domain> gateway e-mail server,
Dear user of e-mail server "<domain>",
Hello user of <domain> e-mail server,
Dear user of "<domain>" mailing system,
Dear user, the management of <domain> mailing system wants to let you know that,

Followed by one of the following paragraphs:
Your e-mail account has been temporary disabled because of unauthorized access.
Our main mailing server will be temporary unavaible for next two days,
to continue receiving mail in these days you have to configure our free
auto-forwarding service.
Your e-mail account will be disabled because of improper using in next
three days, if you are still wishing to use it, please, resign your
account information.
We warn you about some attacks on your e-mail account. Your computer may
contain viruses, in order to keep your computer and e-mail account safe,
please, follow the instructions.
Our antivirus software has detected a large ammount of viruses outgoing
from your email account, you may use our free anti-virus tool to clean up
your computer software.
Some of our clients complained about the spam (negative e-mail content)
outgoing from your e-mail account. Probably, you have been infected by
a proxy-relay trojan server. In order to keep your computer safe,
follow the instructions.

Followed by one of the following lines:
For more information see the attached file.
Further details can be obtained from attached file.
Advanced details can be found in attached file.
For details see the attach.
For details see the attached file.
For further details see the attach.
Please, read the attach for further details.
Pay attention on attached file.

Followed by:
The <domain> team http://www.<domain>

Followed by one of the following lines:
The Management,
Sincerely,
Best wishes,
Have a good day,
Cheers,
Kind regards,

If the attachment is a zip file, the message will include one of the following lines:
For security reasons attached file is password protected. The password is "<password>".
For security purposes the attached file is password protected. Password is "<password>".
Attached file protected with the password for security reasons. Password is <password>.
In order to read the attach you have to use the following password: <password>.

--------------------------------------------------------------------------------

Notes:

<domain> is the domain name part of the email address.
<password> is a 5-digit, random number that the worm used to encrypt the attached .zip file.




DO NOT ENTER A PASSWORD TO ACCESS ANY FILES THAT HAVE BEEN SENT BY EMAIL!!!!!