BD Peacomm Trojan(2)

Description

This signature detects Trojan.Peacomm communicating with its peers.

Additional Information

Trojan.Peacomm is a Trojan horse that drops a driver program file to download another program. It is reportedly attached to spammed email. It may also be dropped by W32.Mixor.Q@mm.

Trojan.Peacomm reportedly arrives as an attachment to a spammed email with the following characteristics:

Subject:
One of the following:

* A killer at 11, he's free at 21 and kill again!
* U.S. Secretary of State Condoleezza Rice has kicked German Chancellor Angela Merkel
* British Muslims Genocide
* Naked teens attack home director.
* 230 dead as storm batters Europe.
* Re: Your text
* Radical Muslim drinking enemies's blood.
* Chinese missile shot down Russian satellite
* Chinese missile shot down Russian aircraft
* Chinese missile shot down USA aircraft
* Chinese missile shot down USA satellite
* Russian missile shot down USA aircraft
* Russian missile shot down USA satellite
* Russian missile shot down Chinese aircraft
* Russian missile shot down Chinese satellite
* Saddam Hussein safe and sound!
* Saddam Hussein alive!
* Venezuelan leader: "Let's the War beginning".
* Fidel Castro dead.


Attachment:
One of the following:

* FullVideo.exe
* Full Story.exe
* Video.exe
* Read More.exe
* FullClip.exe
* GreetingPostcard.exe
* MoreHere.exe
* FlashPostcard.exe
* GreetingCard.exe
* ClickHere.exe
* ReadMore.exe
* FlashPostcard.exe
* FullNews.exe

Affected

• Windows 2000
• Windows 95
• Windows 98
• Windows Me
• Windows NT
• Windows XP

Possible False Positives

There are no known false positives associated with this signature.

Additional References

• Symantec Security Response - Trojan Peacomm