Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: InfoSec Handlers Diary Blog - ".sys" Directories Delivering Driveby Downloads InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

".sys" Directories Delivering Driveby Downloads

Published: 2010-03-24
Last Updated: 2010-03-24 02:42:35 UTC
by Johannes Ullrich (Version: 1)
7 comment(s)

Our read Paul observed malware being delivered from the ".sys" directory of various web sites. The URL follows the scheme:

http://evilexample.com/.sys/?action=....

In response to clicking on the link, the user is asked to install the software. According to Paul, he observed the link being delivered via Facebook which of course makes the message more plausible and it is likely that users install the software thinking it came from a "Friend". Before adding a specific block for ".sys", Paul's web filter caught about 60% of these exploits.

Once a user follows the link, additional exe files are downloaded from ".sys" directories. The file names Paul observed are p.exe, go.exe and v2captcha21.exe.


------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter

7 comment(s)
Diary Archives