Pages

Thursday, February 4, 2010

Feb. 1 DarkMoon-B Video.exe with 222.35.137.193 from masao_tomikawas@yahoo.com 2/1/2010 2:43 AM

This is just an exe (PE32 executable for MS Windows) in zip archive. From China and connecting back to China. Not very creative.

Download Video.exe as a password protected archive (please contact me if you need the password)




From: masao_tomikawas@yahoo.com [mailto:masao_tomikawas@yahoo.com]
Sent: Monday, February 01, 2010 2:43 AM
To: 
Subject: Press(Quake aid starts to arrive for desperate Haitians)
 

PORT-AU-PRINCE, Haiti (AP) - Desperately needed aid from around the world slowly made its way Thursday into Haiti, where supply bottlenecks and a leadership vacuum left rescuers scrambling on their own to save the trapped and injured and get relief supplies into the capital.
..............

see the full text in the end of the post

Headers
Received: (qmail 17548 invoked from network); 1 Feb 2010 07:43:09 -0000
Received: from unknown (HELO fisherxp-pc.domain) (218.67.128.26)
  by XXXXXXXXXXXXXX SMTP; 1 Feb 2010 07:43:09 -0000
Received: from 1428151.com ([127.0.0.1]) by 1428151.com ([127.0.0.1]) with SMTPSVC;
     Mon, 01 Feb 2010 15:43:07 +0800
Message-ID: <6dd17374c7e8d17543324b690c0db2e7@yahoo.com>
From:
To: XXXXXXXXXXXXXXXXXXXXXXXX
Subject: =?gb2312?B?UHJlc3MoUXVha2UgYWlkIHN0YXJ0cyB0byBhcnJpdmUgZm9yIGRlcw==?=
    =?gb2312?B?cGVyYXRlIEhhaXRpYW5zKQ==?=
Date: Mon, 01 Feb 2010 15:43:07 +0800

      Hostname:    218.67.128.26
      ISP:    China Unicom Tianjin province network
      Organization:    China Unicom Tianjin province network
      Country:    China
      City:    Tianjin






File Video.exe received on 2010.02.04 05:37:54 (UTC)
http://www.virustotal.com/analisis/81d634888b069313492b30f737ed07085f335d1cc29964050514412bf5d4b7d1-1265261874
Result: 26/38 (68.43%)
Antivirus     Version     Last Update     Result
a-squared    4.5.0.50    2010.02.04    Trojan.Win32.Agent!IK
AhnLab-V3    5.0.0.2    2010.02.04    Win-Trojan/Agent.45056.AMQ
Antiy-AVL    2.0.3.7    2010.02.03    Trojan/Win32.Agent.gen
Avast    4.8.1351.0    2010.02.02    Win32:Malware-gen
AVG    9.0.0.730    2010.02.03    Agent2.AGLJ
CAT-QuickHeal    10.00    2010.02.04    Trojan.Agent.cvpr
Comodo    3813    2010.02.04    TrojWare.Win32.Trojan.Agent.~IAZ
DrWeb    5.0.1.12222    2010.02.04    Trojan.Siggen.27190
eSafe    7.0.17.0    2010.02.03    Win32.TrojanAgent.Lg
F-Secure    9.0.15370.0    2010.02.04    Trojan:W32/Agent.LGJ
GData    19    2010.02.04    Win32:Malware-gen
Ikarus    T3.1.1.80.0    2010.02.04    Trojan.Win32.Agent
K7AntiVirus    7.10.966    2010.02.03    Trojan.Win32.Agent.dbzx
Kaspersky    7.0.0.125    2010.02.04    Trojan.Win32.Agent.dbzx
McAfee    5881    2010.02.03    Generic.dx!mdo
McAfee+Artemis    5881    2010.02.03    Generic.dx!mdo
McAfee-GW-Edition    6.8.5    2010.02.03    Heuristic.LooksLike.Trojan.Agent.L
Microsoft    1.5406    2010.02.03    Trojan:Win32/Malagent
NOD32    4833    2010.02.03    probably a variant of Win32/Agent
nProtect    2009.1.8.0    2010.02.03    Trojan/W32.Agent.45056.TM
PCTools    7.0.3.5    2010.02.04    Trojan.Generic
Sunbelt    3.2.1858.2    2010.02.04    Trojan.Win32.Generic!SB.0
TheHacker    6.5.1.0.179    2010.02.04    Trojan/Agent.dbzx
TrendMicro    9.120.0.1004    2010.02.04    BKDR_POISON.SME
VBA32    3.12.12.1    2010.02.03    Trojan.Win32.Agent.dbzx
ViRobot    2010.2.4.2171    2010.02.04    Trojan.Win32.Agent.45056.HO
File size: 45056 bytes
MD5...: a4754be7b34ed55faff832edadac61f6

ThreatExpert
http://www.threatexpert.com/report.aspx?md5=a4754be7b34ed55faff832edadac61f6

 Anubis

Connections to 222.35.137.193:220
      Hostname:    222.35.137.193
      ISP:    CHINA RAILWAY TELECOMMUNICATIONS CENTER
      Organization:    CHINA RAILWAY TELECOMMUNICATIONS CENTER
      Country:    China
      City:    Beijing

Full Anubis Log:
http://anubis.iseclab.org/?action=result&task_id=148f3dbf6aeb97894352042e2eb0fdb98&call=first


The international Red Cross estimated that 45,000 to 50,000 people were killed in Tuesday's magnitude-7.0 earthquake.
President Barack Obama announced that "one of the largest relief efforts in our recent history" is moving toward Haiti, with thousands of troops and a broad array of civilian rescue workers flying or sailing in to aid the stricken country - backed by more than $100 million in relief funds.
To the Haitians, Obama promised: "You will not be forsaken."
The nascent flow of rescue workers showed some results: A newly arrived search team pulled a U.N. security worker alive from the organization's collapsed headquarters, where about 100 people are still trapped. He stood, held up a fist in celebration, and was helped to a hospital.
Planes from China, France, Spain and the United States landed at Port-au-Prince's airport, carrying searchers and tons of water, food, medicine and other supplies - with more promised the Western Hemisphere's poorest nation. The international Red Cross estimated 3 million people - a third of the population - may need emergency relief.
The Federal Aviation Administration halted all civilian flights from the United States to
Port-au-Prince at the request of the Haitian government because there is no room on the ground for more planes and not enough jet fuel for planes to go back, an official at the FAA said, speaking on condition of anonymity because he was not authorized to talk publicly.
It took six hours to unload a Chinese plane due to a lack of equipment - a hint of possible bottlenecks ahead as a global response brings a stream of aid flights to the quake-damaged airport.
"We don't have enough handling equipment or the people to run it," said U.S. Air Force Col. Ben McMullin, part of the team handling traffic at the airport. "We're trying to control the flow of aircraft."
In Geneva, Red Cross spokesman Jean-Luc Martinage said the Haitian Red Cross estimated 45,000 to 50,000 people were killed, based on reports from its network of volunteers across Port-au-Prince.
There seemed to be little official Haitian presence in much of the capital - or at the airport.
McMullin said about 60 planes carrying 2,000 people had landed since Wednesday, when the airport reopened, and noon Thursday.
U.S. military forklift operators helped unload some foreign flights as well as U.S. cargos and Haitian staff were far outnumbered by foreign aid workers and military, and no senior Haitian officials were visible.
In the city, trucks carrying police and U.N. workers or equipment to clear away debris were often stuck in traffic on roads filled with pickup trucks, cars and pedestrians. At many collapsed buildings, neighbors and volunteers dug through rubble - often with bare hands - to free trapped residents without help from the government.
Since the earthquake, President Rene Preval has maintained his typical low profile, granting only a couple of media interviews and making few public appearances. His own residences were damaged in the quake and the Parliament building collapsed, along with some other ministries and departments.
State Department spokesman P.J. Crowley said the U.S. had been in touch with Preval, and added: "We're not taking over Haiti. We are helping to stabilize Haiti, we're helping to provide them lifesaving support."
The often-chaotic city was surprisingly calm, despite the devastation, though journalists occasionally heard the sound of isolated gunfire. It was not clear if it was aimed at people. Even in normal times, guards sometimes fire shotguns in the air to keep people away from stores.
There has been widespread looting of collapsed buildings since the earthquake hit, but rarely of undamaged shops, said Matt Marek, Haiti country representative of the American Red Cross.
"There is no other way to get provisions," he told The Associated Press. "Even if you have money, those resources are going to be exhausted in a few days."
Bodies lay in the street, often covered by a white cloth, in the tropical heat. Some people dragged the dust-covered dead along the roads, trying to reach a hospital where they might leave them.
Others tried to carry dead relatives to nearby hills for impromptu burials, prompting Brazil's military - the biggest continent among U.N. peacekeepers - to warn the practice could lead to an epidemic. It said it asked authorities to create a new cemetery.
The Brazilian military said it also was worried that bodies could be left too long because many Voodoo followers in Haiti do not allow the dead to be touched before all their rituals are concluded.
"This is much worse than a hurricane," said Jimitre Coquillon, a doctor's assistant working at a triage center set up in a hotel parking lot. "There's no water. There's nothing. Thirsty people are going to die."
Aid workers reported confusion over how to cope with the sudden flood of aid from scores of places.
"Donations are coming in to the airport here, but some are coming without notice from very well-meaning groups," said Save the Children spokeswoman Kate Conradt. "There is not yet a system to get it in" to those who need it.
Search and rescue squads from Virginia and Iceland arrived Wednesday and some groups - from Cuba's government and Doctors Without Borders - used physicians already in the country to treat victims immediately after the quake.
Obama promised Haitians an all-out rescue and humanitarian effort, including the military and civilian emergency teams from across the U.S., adding that America - and the world - "stands with you."
The U.S. Army said a detachment of more than 100 soldiers from the 82 nd Airborne Division was heading out from Fort Bragg in North Carolina, looking for locations to set up tents and other essentials in preparation for the arrival of another 800 personnel Friday.
That's in addition to some 2,200 Marines to be sent, as the military prepares to help with security, search and rescue missions, and the delivery of humanitarian supplies. More than a half-dozen U.S. military ships also are expected to help, with the largest, the aircraft carrier USS Carl Vinson, arriving later Thursday.
French Foreign Minister Bernard Kouchner said that 91 injured French nationals were evacuated to the Caribbean island of Martinique.
The acrid smell of drywall and dust that filled the air immediately after the quake has faded, giving way to the usual aromas of Port-au-Prince: flowers and mango trees, with a hint of gasoline and urine.
Police officers carried the injured in their pickup trucks. Wisnel Occilus, a 24-year-old student, was wedged between two other survivors in a truck bed headed to a police station. He was in an English class when the quake struck and the building collapsed.
"The professor is dead. Some of the students are dead, too," said Occilus, who suspected he had several broken bones. "Everything hurts."
Other survivors carried injured to hospitals in wheelbarrows and on stretchers fashioned from doors.
About 3,000 police and international peacekeepers cleared debris, directed traffic and maintained security in the capital. But law enforcement was stretched thin even before the quake and would be ill-equipped to deal with major unrest. The U.N.'s 9,000-member peacekeeping force sent patrols across the capital's streets while securing the airport, port and main buildings.
The State Department announced one American had died in Haiti, saying that at least 164 U.S. citizens have been evacuated since the quake.
Coast Guard C-130 planes have airlifted 42 American officials and their families and another 72 private citizens to safety, Crowley said.
Another 370 Americans were awaiting flights out, he said. There were about 45,000 Americans living in Haiti at the time of the earthquake.
The International Committee of the Red Cross said it set up a Web site to help Haitians find missing loved ones. Robert Zimmerman, deputy head of the group's tracing unit, said people in Haiti and abroad can register missing relatives on the site.
___
Associated Press contributors to this story: Jonathan Katz and Jennifer Kay in Port-au-Prince; Edith M. Lederer at the United Nations; Frank Jordans and Bradley S. Klapper in Geneva; Jenny Barchfield in Paris; Pauline Jelinek in Washington; Tales Azzoni in Sao Paulo.
Copyright 2010 The Associated Press

No comments:

Post a Comment