Hangman

__________________
lesen - denken - posten

Hangman

Reserviert für SymbOS.Ruhag.B

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 28.11.2005
auch bekannt als: Appdisabler.I [F-Secure]

Information:

SymbOS.Ruhag.C is a Trojan horse that runs on the Symbian operating system that is used in Nokia Series 60 cellular telephones. The Trojan disables applications on the compromised device.

technische Details:

SymbOS.Ruhag.C may arrive on the device as a file Raghu.sis.

When user clicks on the .sis, the phone installer will display a dialog to warn users that the application may be coming from an untrusted source and may cause potential problems.

If user clicks yes, the phone will displays a message prompting the user to install:

Install
RAGHU



When SymbOS.Ruhag.C is executed, it performs the following actions:

Disables many applications by overwriting files. The following is a list of the applications that are overwritten:

\system\Apps\AD7650\AD7650.app
\system\Apps\AnswRec\AnswRec.app
\system\Apps\BlackList\BlackList.app
\system\Apps\BlueJackX\BlueJackX.app
\system\Apps\callcheater\callcheater.app
\system\Apps\CallManager\CallManager.app
\system\Apps\Camcoder\Camcoder.app
\system\Apps\camerafx\camerafx.app
\system\Apps\ETICamcorder\ETICamcorder.app
\system\Apps\ETIMovieAlbum\ETIMovieAlbum.app
\system\Apps\ETIPlayer\ETIPlayer.app
\system\Apps\extendedrecorder\extendedrecorder.app
\system\Apps\FaceWarp\FaceWarp.app
\system\Apps\FExplorer\FExplorer.app
\system\Apps\FSCaller\FSCaller.app
\system\Apps\Hair\Hair.app
\system\Apps\HantroCP\HantroCP.app
\system\Apps\irremote\irremote.app
\system\Apps\Jelly\Jelly.app
\system\Apps\KPCaMain\KPCaMain.app
\system\Apps\Launcher\Launcher.app
\system\Apps\logoMan\logoMan.app
\system\Apps\MIDIED\MIDIED.app
\system\Apps\mmp\mmp.app
\system\Apps\Mp3Go\Mp3Go.app
\system\Apps\Mp3Player\Mp3Player.app
\system\Apps\photoacute\photoacute.app
\system\Apps\PhotoEditor\PhotoEditor.app
\system\Apps\Photographer\Photographer.app
\system\Apps\PhotoSafe\PhotoSafe.app
\system\Apps\PhotoSMS\PhotoSMS.app
\system\Apps\PVPlayer\PVPlayer.app
\system\Apps\RallyProContest\RallyProContest.app
\system\Apps\realplayer\realplayer.app
\system\Apps\RingMaster\RingMaster.app
\system\Apps\SmartAnswer\SmartAnswer.app
\system\Apps\SmartMovie\SmartMovie.app
\system\Apps\SmsMachine\SmsMachine.app
\system\Apps\Sounder\Sounder.app
\system\Apps\sSaver\sSaver.app
\system\Apps\SystemExplorer\SystemExplorer.app
\system\Apps\UltraMP3\UltraMP3.app
\system\Apps\UVSMStyle\UVSMStyle.app
\system\Apps\WILDSKIN\WILDSKIN.app

Drops the following files to the system:

AboutInstallex0.txt
\RAGHU.txt
\system\RAGHU.txt
\system\apps\RAGHU.app
\system\apps\0A-RAGHU.txt
\Images\RAGHU.txt
\Images\RAGHU CRACK.jpg

Creates the following file:

\system\install\RUHAG.sis

NOTE: This file is actually created by the Installer, not the threat.

[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 05.07.2006
auch bekannt als: keine Angabe

Information:

SymbOS.Ruhag.D is a Trojan horse that runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones. It disables applications on the compromised device.

SymbOS.Ruhag.D reportedly arrives as RAGHU.sis. If a user opens this file, the device Installer will display a dialog to warn the user that the application may be coming from an untrusted source and may cause potential problems.

technische Details:

When SymbOS.Ruhag.D is executed, it performs the following actions:
Displays the following message prompting the user to install the threat:

Install
RAGHU

Displays the following message to the user:

This installer was created with MakeSis 0.9 by [REMOVED]. For info: [REMOVED]

Drops the following files:

[DRIVE LETTER]:\Images\RAGHU CRACK.jpg
[DRIVE LETTER]:\Images\RAGHU.txt
[DRIVE LETTER]:\RAGHU.txt
[DRIVE LETTER]:\system\RAGHU.txt
[DRIVE LETTER]:\system\apps\0A-RAGHU.txt
[DRIVE LETTER]:\system\apps\AD7650\AD7650.App
[DRIVE LETTER]:\system\apps\AnswRec\AnswRec.App
[DRIVE LETTER]:\system\apps\BlackList\BlackList.App
[DRIVE LETTER]:\system\apps\BlueJackX\BlueJackX.App
[DRIVE LETTER]:\system\apps\callcheater\callcheater.app
[DRIVE LETTER]:\system\apps\CallManager\CallManager.App
[DRIVE LETTER]:\system\apps\Camcoder\Camcoder.App
[DRIVE LETTER]:\system\apps\camerafx\CameraFX.App
[DRIVE LETTER]:\system\apps\ETICamcorder\ETICamcorder.App
[DRIVE LETTER]:\system\apps\ETIMovieAlbum\ETIMovieAlbum.App
[DRIVE LETTER]:\system\apps\ETIPlayer\ETIPlayer.App
[DRIVE LETTER]:\system\apps\extendedrecorder\extendedrecorder.Ap p
[DRIVE LETTER]:\system\apps\FExplorer\FExplorer.App
[DRIVE LETTER]:\system\apps\FSCaller\FSCaller.App
[DRIVE LETTER]:\system\apps\FaceWarp\FaceWarp.App
[DRIVE LETTER]:\system\apps\Hair\Hair.App
[DRIVE LETTER]:\system\apps\HantroCP\HantroCP.App
[DRIVE LETTER]:\system\apps\irremote\irRemote.App
[DRIVE LETTER]:\system\apps\Jelly\Jelly.App
[DRIVE LETTER]:\system\apps\KPCaMain\KPCaMain.App
[DRIVE LETTER]:\system\apps\Launcher\Launcher.app
[DRIVE LETTER]:\system\apps\logoMan\logoMan.app
[DRIVE LETTER]:\system\apps\MIDIED\MIDIED.App
[DRIVE LETTER]:\system\apps\mmp\mmp.App
[DRIVE LETTER]:\system\apps\Mp3Go\Mp3Go.App
[DRIVE LETTER]:\system\apps\Mp3Player\Mp3Player.App
[DRIVE LETTER]:\system\apps\PVPlayer\PVPlayer.App
[DRIVE LETTER]:\system\apps\photoacute\photoacute.App
[DRIVE LETTER]:\system\apps\PhotoEditor\PhotoEditor.app
[DRIVE LETTER]:\system\apps\PhotoSMS\PhotoSMS.App
[DRIVE LETTER]:\system\apps\PhotoSafe\PhotoSafe.App
[DRIVE LETTER]:\system\apps\Photographer\Photographer.app
[DRIVE LETTER]:\system\apps\RAGHUMenu\RAGHUMENU.APP
[DRIVE LETTER]:\system\apps\RAGHUMenu\RAGHUMENU.RSC
[DRIVE LETTER]:\system\apps\RAGHUMenu\RAGHUMenu_caption.rsc
[DRIVE LETTER]:\system\apps\RAGHU\RAGHU.app
[DRIVE LETTER]:\system\apps\RallyProContest\RallyProContest.App
[DRIVE LETTER]:\system\apps\realplayer\realplayer.App
[DRIVE LETTER]:\system\apps\RingMaster\RingMaster.App
[DRIVE LETTER]:\system\apps\SmartAnswer\SmartAnswer.App
[DRIVE LETTER]:\system\apps\SmartMovie\SmartMovie.App
[DRIVE LETTER]:\system\apps\SmsMachine\SmsMachine.App
[DRIVE LETTER]:\system\apps\Sounder\Sounder.App
[DRIVE LETTER]:\system\apps\sSaver\sSaver.App
[DRIVE LETTER]:\system\apps\SystemExplorer\SystemExplorer.App
[DRIVE LETTER]:\system\apps\UVSMStyle\UVSMStyle.App
[DRIVE LETTER]:\system\apps\UltraMP3\UltraMP3.App
[DRIVE LETTER]:\system\apps\WILDSKIN\WILDSKIN.App

Note:
The dropped .app files are all corrupted.
The dropped RAGHU.txt files are identical. They contain the following text:

----R A G H U----

VIRUS BORN IN SURAT [REMOVED] ILABLE SOON....

RAGHU NAM HE RAGHU...

The dropped 0A-RAGHU.txt file contains the following text:

MY NAME IS -----R A G H U-----


FROM [REMOVED] L RAGHU.SIS ITS HARMFULL FOR YOUR MOBILE

The following file is also created by the device Installer, not the threat:

[DRIVE LETTER]:\system\install\RAGHU.sis

[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 06.07.2006
auch bekannt als: keine Angabe

Information:

SymbOS.Ruhag.E is a Trojan horse that runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones. The Trojan disables applications on the compromised device.

SymbOS.Ruhag.E reportedly arrives as RAGHU.sis. If a user opens this file, the device Installer will display a dialog to warn the user that the application may be coming from an untrusted source and may cause potential problems.

technische Details:

When SymbOS.Ruhag.E is executed, it performs the following actions:
Displays the following message prompting the user to install the threat:

Install
RAGHU

Drops the following files, some of which disable applications by overwriting files:

C:\system\apps\RINUMenu\RINUMenu.APP
C:\system\apps\RINUMenu\RINUMenu.RSC
C:\system\apps\RINUMenu\RINUMenu_caption.rsc
[DRIVE LETTER]:\Copy (10) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (100) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (101) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (11) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (12) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (13) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (14) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (15) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (16) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (17) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (18) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (19) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (2) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (20) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (21) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (22) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (23) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (24) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (25) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (26) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (27) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (28) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (29) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (3) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (30) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (31) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (32) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (33) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (34) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (35) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (36) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (37) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (38) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (39) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (4) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (40) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (41) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (42) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (43) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (44) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (45) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (46) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (47) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (48) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (49) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (5) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (50) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (51) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (52) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (53) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (54) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (55) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (56) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (57) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (58) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (59) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (6) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (60) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (61) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (62) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (63) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (64) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (65) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (66) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (67) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (68) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (69) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (7) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (70) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (71) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (72) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (73) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (74) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (75) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (76) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (77) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (78) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (79) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (8) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (80) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (81) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (82) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (83) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (84) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (85) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (86) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (87) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (88) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (89) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (9) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (90) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (91) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (92) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (93) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (94) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (95) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (96) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (97) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (98) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy (99) of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Copy of RAGHU_RINU\sSaver.App
[DRIVE LETTER]:\Images\Image(03).JPG
[DRIVE LETTER]:\Images\RAGHU CRACK.jpg
[DRIVE LETTER]:\Images\RAGHU.txt
[DRIVE LETTER]:\Images\Thumbs.db
[DRIVE LETTER]:\RAGHU.txt
[DRIVE LETTER]:\RAGHU_RINU\raghu
[DRIVE LETTER]:\system\RAGHU.txt
[DRIVE LETTER]:\system\apps\AnswRec\AnswRec.App
[DRIVE LETTER]:\system\apps\BlackList\BlackList.App
[DRIVE LETTER]:\system\apps\BlueJackX\BlueJackX.App
[DRIVE LETTER]:\system\apps\callcheater\callcheater.app
[DRIVE LETTER]:\system\apps\CallManager\CallManager.App
[DRIVE LETTER]:\system\apps\Camcoder\Camcoder.App
[DRIVE LETTER]:\system\apps\camerafx\CameraFX.App
[DRIVE LETTER]:\system\apps\ETICamcorder\ETICamcorder.App
[DRIVE LETTER]:\system\apps\ETIMovieAlbum\ETIMovieAlbum.App
[DRIVE LETTER]:\system\apps\ETIPlayer\ETIPlayer.App
[DRIVE LETTER]:\system\apps\extendedrecorder\extendedrecorder.Ap p
[DRIVE LETTER]:\system\apps\FExplorer\FExplorer.App
[DRIVE LETTER]:\system\apps\FSCaller\FSCaller.App
[DRIVE LETTER]:\system\apps\FaceWarp\FaceWarp.App
[DRIVE LETTER]:\system\apps\Hair\Hair.App
[DRIVE LETTER]:\system\apps\HantroCP\HantroCP.App
[DRIVE LETTER]:\system\apps\irremote\irRemote.App
[DRIVE LETTER]:\system\apps\Jelly\Jelly.App
[DRIVE LETTER]:\system\apps\KPCaMain\KPCaMain.App
[DRIVE LETTER]:\system\apps\Launcher\Launcher.app
[DRIVE LETTER]:\system\apps\logoMan\logoMan.app
[DRIVE LETTER]:\system\apps\MIDIED\MIDIED.App
[DRIVE LETTER]:\system\apps\mmp\mmp.App
[DRIVE LETTER]:\system\apps\Mp3Go\Mp3Go.App
[DRIVE LETTER]:\system\apps\Mp3Player\Mp3Player.App
[DRIVE LETTER]:\system\apps\PVPlayer\PVPlayer.App
[DRIVE LETTER]:\system\apps\photoacute\photoacute.App
[DRIVE LETTER]:\system\apps\PhotoEditor\PhotoEditor.app
[DRIVE LETTER]:\system\apps\PhotoSMS\PhotoSMS.App
[DRIVE LETTER]:\system\apps\PhotoSafe\PhotoSafe.App
[DRIVE LETTER]:\system\apps\Photographer\Photographer.app
[DRIVE LETTER]:\system\apps\RAGHU.txt
[DRIVE LETTER]:\system\apps\RAGHUMenu\RAGHUMENU.APP
[DRIVE LETTER]:\system\apps\RAGHUMenu\RAGHUMENU.RSC
[DRIVE LETTER]:\system\apps\RAGHUMenu\RAGHUMenu_caption.rsc
[DRIVE LETTER]:\system\apps\RAGHU\RAGHU.app
[DRIVE LETTER]:\system\apps\RallyProContest\RallyProContest.App
[DRIVE LETTER]:\system\apps\realplayer\realplayer.App
[DRIVE LETTER]:\system\apps\RingMaster\RingMaster.App
[DRIVE LETTER]:\system\apps\SmartAnswer\SmartAnswer.App
[DRIVE LETTER]:\system\apps\SmartMovie\SmartMovie.App
[DRIVE LETTER]:\system\apps\SmsMachine\SmsMachine.App
[DRIVE LETTER]:\system\apps\Sounder\Sounder.App
[DRIVE LETTER]:\system\apps\sSaver\sSaver.App
[DRIVE LETTER]:\system\apps\SystemExplorer\SystemExplorer.App
[DRIVE LETTER]:\system\apps\UVSMStyle\UVSMStyle.App
[DRIVE LETTER]:\system\apps\UltraMP3\UltraMP3.App
[DRIVE LETTER]:\system\apps\WILDSKIN\WILDSKIN.App

Note:
The dropped .app files are all corrupted.
The dropped RAGHU.txt files are identical. They contain the following text:

----R A G H U-C R A C K----

VIRUS BORN IN SURAT(GUJRAT/INDIA/ASIA).

[REMOVED]

PRODUCTS....

1.RAGHU.SIS (VIRUS)
2.RAGHU_R.SIS (VIRUS)
3.RAGHU_C.SIS (VIRUS)
4.RAGHU_MP3 PLAYER.SIS (TWO IN ONE MP3 PLAYER)

The following file is also created by the device Installer, not the threat:

[DRIVE LETTER]:\system\install\RAGHU.sis

[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten