Hangman

__________________
lesen - denken - posten

Hangman

Risiko: Trojanisches Pferd
Typ: Trojanisches Pferd
entdeckt am: 05.12.2005
auch bekannt als: SYMBOS_PBSTEAL.C [Trend Micro]

Information:

SymbOS.Pbstealer.B is a Trojan horse that runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones. The Trojan sends the user's contact information database, Notepad, and Calendar To Do list to other Bluetooth-enabled devices.

SymbOS.Pbstealer.B reportedly arrives as PBCompressor.sis.

technische Details:

When SymbOS.Pbstealer.B is executed, it performs the following actions:
Copies itself as the following file:

PBCompressor.sis

Note: If a user opens this file, the device Installer will display a dialog to warn the user that the application may be coming from an untrusted source and may cause potential problems.

If the user clicks yes, the phone will display a message prompting the user to Install:

PBCompressor



Installs itself as the following files:

C:\system\Mail\00110001_S\pbcompressor.app
C:\system\Mail\00110001_S\pbcompressor.rsc

Copies the contents of the user's contact information database, Notepad, and Calendar To Do list to the following file:

C:\SYSTEM\MAIL\PHONEBOOK.TXT

Scans for Bluetooth-enabled devices. It repeatedly attempts to send the file C:\SYSTEM\MAIL\PHONEBOOK.TXT to the first Bluetooth-enabled device it finds. After one minute the Trojan stops trying to send the file via Bluetooth. However, the Trojan appears to contain some bugs, and it may crash and stop running.

[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 03.01.2006
auch bekannt als: Pbstealer.D [F-Secure], Trojan-Spy.SymbOS.Pbstealer.c , SymbOS/PBsender.gen!sis [McAfee]

Information:

SymbOS.Pbstealer.C is a Trojan horse that runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones. The Trojan sends the user's contact information database, Notepad, and Calendar To Do list to other Bluetooth-enabled devices.

SymbOS.Pbstealer.C reportedly arrives as PBCompressory.SIS.

technische Details:

When SymbOS.Pbstealer.C is executed, it performs the following actions:
Copies itself as the following file:

PBCompressor.SIS

Note: If the user opens this .sis file, the device Installer will display a dialog to warn the user that the application may be coming from an untrusted source and may cause potential problems.

If the user clicks yes, the device displays the following message prompting the user to install the PBCompressor.SIS file:

Install:

PBCompressor

The following message may subsequently be displayed during the installation process:

Compacting your contact(s), step2

Please wait again
until done...

Copies itself as the following files:

C:\system\Mail\00110001_S\pbcompressor.app
C:\system\Mail\00110001_S\pbcompressor.rsc

Copies the contents of the user's contact information database, Notepad, and Calendar To Do list to the following file:

C:\SYSTEM\MAIL\PHONEBOOK.TXT

Scans for Bluetooth-enabled devices. It repeatedly attempts to send the file C:\SYSTEM\MAIL\PHONEBOOK.TXT to the first Bluetooth-enabled device it finds.

Stops trying to send the above file via Bluetooth after one minute and displays the following message:

Compacting your contact(s), step2
Done!!!

Once the user has selected "Done, press OK to exit" (after the threat has stolen and sent the Phonebook details), the Trojan will delete the following files in an attempt to hide its presence on the compromised device:

C:\system\Mail\00110001_S\pbcompressor.app
C:\system\Mail\00110001_S\pbcompressor.rsc
C:\SYSTEM\MAIL\PHONEBOOK.TXT
PBCompressor.SIS
C:\system\install\PBCompressor.SIS

However, the Trojan appears to contain several bugs, and it may crash and stop running.

The following file is also created by the device Installer, not the threat:

\system\install\PBCompressor.SIS

[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 18.01.2006
auch bekannt als: SYMBOS_PBSTEAL.D [Trend Micro]

Information:

SymbOS.Pbstealer.D is a Trojan horse that runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones. The Trojan sends the user's contact information database, Notepad, and Calendar To Do list to other Bluetooth-enabled devices.

It has been reported that the Trojan arrives on the compromised device as the following files:
ChattingYuk.SIS
PBCompressor.SIS

If the user opens this .sis file, the device Installer displays a dialog box to warn the user that the application may be coming from an untrusted source and may cause potential problems.

technische Details:

When SymbOS.Pbstealer.D is executed, it performs the following actions:
Displays one of the following messages, depending on the threat version:

Message 1:
Install
MyProfile

Message 2:
Install
PBCompressor
Displays the following message if the user installs the file:

Compacting
your contact(s), step2

Please wait again
until done...

Installs itself as the following files:

C:\system\Mail\00110001_S\pbcompressor.app
C:\system\Mail\00110001_S\pbcompressor.rsc

Copies the contents of the user's contact information database, Notepad, and Calendar To Do list to the following file:

C:\SYSTEM\MAIL\PHONEBOOK.TXT

Scans for Bluetooth-enabled devices. It repeatedly attempts to send the file C:\SYSTEM\MAIL\PHONEBOOK.TXT to the first Bluetooth-enabled device it finds.

Stops trying to send the above file via Bluetooth after one minute and displays the following message:

Compacting your contact(s), step2
Done!!!

Note: The Trojan appears to contain some bugs, and it may crash and stop running.

One of the following files is created by the Installer, not the threat:
\system\install\ChattingYuk.SIS
\system\install\PBCompressor.SIS

Deletes the above files and also deletes the Installer and the Install Stub left in the C:\System\Apps\Install directory to hide its tracks after the user has selected "Done, press OK to exit" (after the threat has stolen and sent the Phonebook details).

[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten