|
|
A new Nirbot variant has been discovered that attempts to exploit the recent zero day vulnerability in Microsoft’s DNS Server Service (CVE-2007-1748).
Vulnerability to Worm Timeline:
Analysis is on going. More details will be posted here.
Update April 16, 20:30 PDT
A second variant has been discovered.
First Variant
File Name: mdnex.exe (writes c:\U.exe)
File Size: 199,680 bytes
MD5: 0xc1a6a22b2415ba608fb894b4e036e19c
Second Variant
File Name: mozila.exe (writes c:\U.exe)
File Size: 270,848 bytes
MD5: 0x8f6cb8d895e60387fe3e41377d0f0d3f
|
|