Re: Stormy P2P bot Sigs -- may be SKYPE ?

Ummm... that's a little scary.

To be honest, when I was looking at those stormy variants the traffic
didn't exactly conform to edonkey, but was close. It's VERY possible it
may have been skype and I've written for the wrong protocol.

Let me look into it and see what'll match. Anyone else seeing skype hits?

Matt

Russell Fulton wrote:
> 
> Matt Jonkman wrote:
>> Finding more detail, this does indeed look like edonkey traffic on an
>> unusual port.
>>
>> I'm working on making better sigs, and might pull these shortly. If
>> anyone is interested here are the references I'm looking at:
>>
>> http://www.giac.org/certified_professionals/practicals/gcih/0446.php
>> ftp://ftp.kom.e-technik.tu-darmstadt.de/pub/papers/HB02-1-paper.pdf
>>
>> We may just need to redo the existing edonkey sigs, which look only at
>> ports 4660:4799. This trojan runs with a source port of 7871, which is
>> rather unusual...
>>
>> Any edonkey experts out there?
>>
>>   
> Hmmmm... My edonkey alerts have gone crazy recently.  I know that at
> least some of the machines (the ones I checked ) are not doing any p2p
> file sharing, nor is there any signs of infection or compromise.  All 3
> however were running Skype.   Is it possible that changes have been made
> to the skype protocol which results in a lot of packets with 0XE3 at the
> start?
> 
> 
> Russell
> 
> _______________________________________________
> Bleeding-sigs mailing list
> Bleeding-sigs-WwB1pFISwSkm7effSn6vN9HuzzzSOjJt@xxxxxxxxxxxxxxxx
> http://lists.bleedingthreats.net/cgi-bin/mailman/listinfo/bleeding-sigs

-- 
--------------------------------------------
Matthew Jonkman
Bleeding Edge Threats
765-429-0398
765-807-3060 fax
http://www.bleedingthreats.net
--------------------------------------------

PGP: http://www.bleedingthreats.com/mattjonkman.asc