In keeping with this Halloween season, I'm starting a series on scary malware tricks, similar to last year's series on spyware tricks. Perhaps my personal focus has changed, but it seems to me spyware tricks are becoming far more devious and destructive.
In keeping with this Halloween season, I'm starting a series on scary malware tricks, similar to last year's series on spyware tricks. Perhaps my personal focus has changed, but it seems to me spyware tricks are becoming far more devious and destructive. Last year I was testing mostly adware, whereas this year I'm testing more trojans, backdoors, rootkits, etc. Also scary -- botnets are reportedly growing in frightening numbers.
The name of the malware process on the infected iPods is RavMone.exe. Symantec has a good description here, calling it W32.Rajump. When I first read the description, the name was Backdoor.Rajump, but either way, its malicious payload is the same. On initial infection, the malware creates RavMone.exe in the Windows directory and puts itself in a Run key in the registry to make sure it starts with every Windows boot-up. Symantec says it open a TCP port and immediately tries to phone home to the following URLs:
What happens next is anyone's guess, but with a backdoor, it can be ugly. Both domains shown appear to be Chinese, as seen here and here. There has been some speculation that perhaps the infected iPods were shipped from a "contract manufacturer", using Apple's words, in China, but I've not seen any confirmation of that. If anyone has a sample of RavMone.exe, I'd be interested in getting it to test. My ZDNet bio has a contact form here.
Another example of very scary technology is the Gromozon rootkit, aka Trojan.LinkOptimizer. I'll write about Gromozon in the next article in the series.
Jason Hiner: With industry giants like Cisco, Apple,
Microsoft and Google racking up huge cash reserves,
and the market price of many public tech companies
on a "50% off sale", consolidation is in the air.
Although the IBM-Sun deal fell apart, expect more
tech acquisitions in 2009. These are most likely...