The Cyber war between Egypt and Israel have taken very dangerous turn by setting normal internet users as target for botnet attacks. Since week ago some Egyptian hackers attacked so many Israeli's gov communities and organizations on the internet. Israeli prime minister Netanyahus for example . But yet it wasn't very scary attacks level , as it was farfrom the normal computer users.
In Sudden escalation for the attack level , an Egyptian group launched computer worm which infected about 50000 personal computer in Israel and united states. Despite of my virtual machine security level , itwas also infected by the same worm. I (Reuben Rayner) didn'tnotice that am infected till the attackers launched an exe file which viewed message in the full screen mode.
Quits of the attackers message they started with the word "Anti-Zionism"
you can read the full message via the picture above, but what make this attack unique?? Ok , have you viewed Israel gov sites yesterday? Try pinging mossad.gov.il for example
The pinging result
C:\>ping mossad.gov.il -ttl
Pinging mossad.gov.il [147.237.72.71] with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
What's the point??
If the attackers used the same massive bots to attack sensitivegov sites , this will probably cause a disaster.
If they did it and dumped the banking accounts of thousands and thousands of users they got , this will also cause disaster.
Little analysis for the worm
I (Reuben Rayner) am trying to get a copy of this worm now togive detailed analysis but it's using a unique technique to attack spread over computers
- usb spread.
- inject itself within executable files
- injecting malicious html codes through out user's pc
- it's always trying to use the fake msn account in my virtual machine to send malicious links
- sending the antivirus update requests to fake server addresses so you will always think that ur AV is updated , butactually it isn't.
- disabling firewall software > comodo in my vpc
other techniques still unknown to me
While surfing through internet I(Reuben Rayner) found some topics asking for help about that worm. All asking the same question , what should I (Reuben Rayner) do? You have to format your C drive and re-install windows. Once installation is finished don't open any exe file , juts copy firewall software from the internet. Install it and block any request from exe files to modify registry or connecting to internet. Download Avira , install it and update it now it's able to detect this malware. Scan your computer and remove any infected file , now you are safe :)
Submitted By : Reuben Rayner
Email : reuben_r@rocketmail.com
source
In Sudden escalation for the attack level , an Egyptian group launched computer worm which infected about 50000 personal computer in Israel and united states. Despite of my virtual machine security level , itwas also infected by the same worm. I (Reuben Rayner) didn'tnotice that am infected till the attackers launched an exe file which viewed message in the full screen mode.
Quits of the attackers message they started with the word "Anti-Zionism"
" If u can see this message this mean that u either from israel orfrom USA > both sucksNames and Arabic sites and yet they seem to be funny enough to let them worm talk to the user > me
your stupid zionist soliders passed through the Egyptian borders and killed 3 soldiers andthat's not good for u.
now our army became 79999997 instead of 80000000, they all ready to kick ur fat asses :)"
it seem that it also about the border problem between Egypt and Israel
"our strike is just the beginning, u can say it's a simple bullet , but the nuclear strike is comming soon :)
this is not your only fate , so don't be sad , this fate is waiting thousands of zionist users
watch this pic : http://adf.ly/2R8A1"
Threatening that they are more attacks against Zionists and attaching a picture of their ownbot network.
"Striked By : sTrIk3r, i-Hmx , H311 C0D3 & K4rar
shouts to all elite hackers at sec4ever.com, alm3refh.comand 1337s.cc
now let Our Worm talk to u about herself for seconds . . . "
you can read the full message via the picture above, but what make this attack unique?? Ok , have you viewed Israel gov sites yesterday? Try pinging mossad.gov.il for example
The pinging result
C:\>ping mossad.gov.il -ttl
Pinging mossad.gov.il [147.237.72.71] with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
What's the point??
If the attackers used the same massive bots to attack sensitivegov sites , this will probably cause a disaster.
If they did it and dumped the banking accounts of thousands and thousands of users they got , this will also cause disaster.
Little analysis for the worm
I (Reuben Rayner) am trying to get a copy of this worm now togive detailed analysis but it's using a unique technique to attack spread over computers
- usb spread.
- inject itself within executable files
- injecting malicious html codes through out user's pc
- it's always trying to use the fake msn account in my virtual machine to send malicious links
- sending the antivirus update requests to fake server addresses so you will always think that ur AV is updated , butactually it isn't.
- disabling firewall software > comodo in my vpc
other techniques still unknown to me
While surfing through internet I(Reuben Rayner) found some topics asking for help about that worm. All asking the same question , what should I (Reuben Rayner) do? You have to format your C drive and re-install windows. Once installation is finished don't open any exe file , juts copy firewall software from the internet. Install it and block any request from exe files to modify registry or connecting to internet. Download Avira , install it and update it now it's able to detect this malware. Scan your computer and remove any infected file , now you are safe :)
Submitted By : Reuben Rayner
Email : reuben_r@rocketmail.com
source
