winpcap+sTerm

What is sTerm?

--------------

sTerm is a Telnet client with a unique feature. It can establish an entire bi-directional Telnet session to a target host never sending your real IP and MAC addresses in any packet. Using "ARP Poisoning", "MAC Spoofing" and "IP Spoofing" techniques sTerm can effectively bypass ACLs, Firewall rules and IP restrictions on servers and network devices.

The connection will be done impersonating a Trusted Host.



virus control sTerm: http://www.virustotal.com/nl/analisis/802da002ee7604b98dbff348c59606632dc397706f9e85d8766082b4f20f2ee6-1241491822

--------------------



a-squared 4.0.0.101 2009.05.05 Riskware.PSWTool.Win32.Cain.284!IK

AhnLab-V3 5.0.0.2 2009.05.04 -

AntiVir 7.9.0.160 2009.05.04 -

Antiy-AVL 2.0.3.1 2009.04.30 -

Authentium 5.1.2.4 2009.05.04 -

Avast 4.8.1335.0 2009.05.04 -

AVG 8.5.0.327 2009.05.04 -

BitDefender 7.2 2009.05.04 -

CAT-QuickHeal 10.00 2009.05.04 -

ClamAV 0.94.1 2009.05.04 -

Comodo 1149 2009.05.03 -

DrWeb 4.44.0.09170 2009.05.05 -

eSafe 7.0.17.0 2009.05.03 -

eTrust-Vet 31.6.6489 2009.05.05 -

F-Prot 4.4.4.56 2009.05.04 -

F-Secure 8.0.14470.0 2009.05.04 -

Fortinet 3.117.0.0 2009.05.05 -

GData 19 2009.05.05 -

Ikarus T3.1.1.49.0 2009.05.05 not-a-virus:PSWTool.Win32.Cain.284

K7AntiVirus 7.10.723 2009.05.04 -

Kaspersky 7.0.0.125 2009.05.05 -

McAfee 5605 2009.05.04 -

McAfee+Artemis 5605 2009.05.04 -

McAfee-GW-Edition 6.7.6 2009.05.04 -

Microsoft 1.4602 2009.05.04 -

NOD32 4052 2009.05.04 -

Norman 6.01.05 2009.05.04 -

nProtect 2009.1.8.0 2009.05.04 -

Panda 10.0.0.14 2009.05.04 -

PCTools 4.4.2.0 2009.05.03 -

Prevx1 3.0 2009.05.05 -

Rising 21.28.04.00 2009.05.04 -

Sophos 4.41.0 2009.05.05 -

Sunbelt 3.2.1858.2 2009.05.05 -

Symantec 1.4.4.12 2009.05.05 -

TheHacker 6.3.4.1.318 2009.05.04 -

TrendMicro 8.950.0.1092 2009.05.04 -

VBA32 3.12.10.4 2009.05.04 -

ViRobot 2009.5.4.1719 2009.05.04 -

VirusBuster 4.6.5.0 2009.05.04 -

Extra informatie

File size: 921724 bytes

MD5 : 094aa82d9bd41a6483e74cca7799646b

SHA1 : 2eed9ca00b6722f6d05854a40a5f69e05ceb8ebb

SHA256: 802da002ee7604b98dbff348c59606632dc397706f9e85d8766082b4f20f2ee6

PEInfo: PE Structure information



( base data )

entrypointaddress.: 0x31A0

timedatestamp.....: 0x338B6859 (Wed May 28 01:03:53 1997)

machinetype.......: 0x14C (Intel I386)



( 6 sections )

name viradd virsiz rawdsiz ntrpy md5

.text 0x1000 0x3D04 0x3E00 6.42 0dd05b8f8510932a61a191ae834be4c0

.rdata 0x5000 0x3A9 0x400 4.85 2d05733bc594b6a7937a6b504cb4c843

.data 0x6000 0x1578 0x1400 1.66 6980dcc5b84f08571e5547cc54d19be9

.idata 0x8000 0x7C2 0x800 5.00 582f61065d25bb6aa1fe226de4ed6a52

.rsrc 0x9000 0x39C 0x400 3.18 0e905c482a33ae10794d8d5072f26867

.reloc 0xA000 0x67C 0x800 5.30 7b8d1da59fd73510c8411c87eebb7f13



( 3 imports )



> gdi32.dll: DeleteObject, GetDeviceCaps, RealizePalette, GetStockObject, SelectObject, PatBlt, SelectPalette, CreatePalette, CreateSolidBrush

> kernel32.dll: LoadLibraryA, _lopen, _lcreat, lstrcpyA, GetProcAddress, _lclose, lstrlenA, GetWindowsDirectoryA, GlobalHandle, _lwrite, _llseek, FreeLibrary, WinExec, GlobalFree, _lread, GlobalUnlock, GetModuleFileNameA, SetErrorMode, GlobalLock, GetLastError, GetCurrentProcess, WriteFile, GetStdHandle, GetFileType, SetHandleCount, GetOEMCP, GetACP, GetCPInfo, WideCharToMultiByte, GetEnvironmentStringsW, GlobalAlloc, DeleteFileA, FreeEnvironmentStringsA, GetEnvironmentStrings, RtlUnwind, VirtualAlloc, UnhandledExceptionFilter, HeapCreate, HeapDestroy, HeapAlloc, HeapFree, ExitProcess, TerminateProcess, FreeEnvironmentStringsW, VirtualFree, GetFileAttributesA, GetModuleHandleA, GetStartupInfoA, GetCommandLineA, GetVersion

> user32.dll: ExitWindowsEx, LoadCursorA, MessageBoxA, RegisterClassA, SetWindowPos, LoadIconA, UpdateWindow, ShowWindow, ReleaseDC, wsprintfA, PostQuitMessage, BeginPaint, EndPaint, DefWindowProcA, SendMessageA, InvalidateRect, GetClientRect, CreateWindowExA, GetDC



( 1 exports )



> _MainWndProc@16, _StubFileWrite@12

TrID : File type identification

71.5% (.EXE) Win32 Executable MS Visual C++ 4.x (134693/65)

16.5% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)

4.5% (.EXE) Win32 Executable Generic (8527/13/3)

4.0% (.DLL) Win32 Dynamic Link Library (generic) (7583/30/2)

1.1% (.EXE) Win16/32 Executable Delphi generic (2072/23)

ssdeep: 24576:ZvY6xr6OciUstocdV3lV0WCN/SX8Dj0lSCYAJW+ExCit1Y:ZvY6xoiRtoO0WCN7j08CZW+YCIY

PEiD : -

packers (Kaspersky): PE_Patch

RDS : NSRL Reference Data Set



What is WINPCAP?

---------------

WinPcap is the industry-standard tool for link-layer network access in Windows environments: it allows applications to capture and transmit network packets bypassing the protocol stack, and has additional useful features, including kernel-level packet filtering, a network statistics engine and support for remote packet capture.



WinPcap consists of a driver, that extends the operating system to provide low-level network access, and a library that is used to easily access the low-level network layers. This library also contains the Windows version of the well known libpcap Unix API.



Thanks to its set of features, WinPcap is the packet capture and filtering engine of many open source and commercial network tools, including protocol analyzers, network monitors, network intrusion detection systems, sniffers, traffic generators and network testers. Some of these tools, like Wireshark, Nmap, Snort, ntop are known and used throughout the networking community.



Winpcap.org is also the home of WinDump, the Windows version of the popular tcpdump tool. WinDump can be used to watch, diagnose and save to disk network traffic according to various complex rules.



virus control winpcap: http://www.virustotal.com/nl/analisis/a100dc629f64e4f6901fe0e2882431988f2d45b8b8522be992c88c52f78db198-1244302222

----------------------



a-squared 4.0.0.101 2009.06.04 -

AhnLab-V3 5.0.0.2 2009.06.05 -

AntiVir 7.9.0.180 2009.06.06 -

Antiy-AVL 2.0.3.1 2009.06.05 -

Authentium 5.1.2.4 2009.06.05 -

Avast 4.8.1335.0 2009.06.05 -

AVG 8.5.0.339 2009.06.06 -

BitDefender 7.2 2009.06.06 -

CAT-QuickHeal 10.00 2009.06.06 -

ClamAV 0.94.1 2009.06.06 -

Comodo 1203 2009.06.06 -

DrWeb 5.0.0.12182 2009.06.06 -

eSafe 7.0.17.0 2009.06.04 Win32.Infostealer.ga

eTrust-Vet 31.6.6542 2009.06.05 -

F-Prot 4.4.4.56 2009.06.05 -

F-Secure 8.0.14470.0 2009.06.05 -

Fortinet 3.117.0.0 2009.06.06 -

GData 19 2009.06.06 -

Ikarus T3.1.1.59.0 2009.06.06 -

K7AntiVirus 7.10.754 2009.06.04 -

Kaspersky 7.0.0.125 2009.06.06 -

McAfee 5637 2009.06.05 -

McAfee+Artemis 5637 2009.06.05 -

McAfee-GW-Edition 6.7.6 2009.06.06 -

Microsoft 1.4701 2009.06.06 -

NOD32 4135 2009.06.06 -

Norman 2009.06.05 -

nProtect 2009.1.8.0 2009.06.06 -

Panda 10.0.0.14 2009.06.06 -

PCTools 4.4.2.0 2009.06.06 -

Prevx 3.0 2009.06.06 -

Rising 21.32.52.00 2009.06.06 -

Sophos 4.42.0 2009.06.06 -

Sunbelt 3.2.1858.2 2009.06.06 -

Symantec 1.4.4.12 2009.06.06 -

TheHacker 6.3.4.3.340 2009.06.05 -

TrendMicro 8.950.0.1092 2009.06.06 -

VBA32 3.12.10.6 2009.06.06 -

ViRobot 2009.6.5.1771 2009.06.05 -

VirusBuster 4.6.5.0 2009.06.05 -

Extra informatie

File size: 550560 bytes

MD5 : 2b8f5a693275102ae1d48fc138685c80

SHA1 : d91b76628757c5d2f5cbb3963dc0d8d8e9d816a5

SHA256: a100dc629f64e4f6901fe0e2882431988f2d45b8b8522be992c88c52f78db198

PEInfo: PE Structure information



( base data )

entrypointaddress.: 0x3166

timedatestamp.....: 0x4436A88E (Fri Apr 7 19:59:42 2006)

machinetype.......: 0x14C (Intel I386)



( 5 sections )

name viradd virsiz rawdsiz ntrpy md5

.text 0x1000 0x5BEE 0x5C00 6.49 9f6410aa81245821423eda0653b96809

.rdata 0x7000 0x11FE 0x1200 5.28 74487a69e7662347f676ab791311704a

.data 0x9000 0x260D4 0x400 5.22 0c28ca8b37fd6905571c02881b4bf528

.ndata 0x30000 0xD000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e

.rsrc 0x3D000 0x4388 0x4400 5.84 25a51c448c0fbe51d72d004fb445d7f9



( 8 imports )



> advapi32.dll: RegQueryValueExA, RegSetValueExA, RegEnumKeyA, RegEnumValueA, RegOpenKeyExA, RegDeleteKeyA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA

> comctl32.dll: ImageList_AddMasked, ImageList_Destroy, -, ImageList_Create

> gdi32.dll: SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectA, SetBkMode, SetTextColor, SelectObject

> kernel32.dll: CloseHandle, SetFileTime, CompareFileTime, SearchPathA, GetShortPathNameA, GetFullPathNameA, MoveFileA, SetCurrentDirectoryA, GetFileAttributesA, GetLastError, CreateDirectoryA, SetFileAttributesA, Sleep, GetFileSize, GetModuleFileNameA, GetTickCount, GetCurrentProcess, lstrcmpiA, ExitProcess, GetCommandLineA, GetWindowsDirectoryA, GetTempPathA, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, lstrlenA, lstrcatA, GetSystemDirectoryA, lstrcmpA, GetEnvironmentVariableA, ExpandEnvironmentStringsA, GlobalFree, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, SetErrorMode, GetModuleHandleA, LoadLibraryA, GetProcAddress, FreeLibrary, MultiByteToWideChar, WritePrivateProfileStringA, GetPrivateProfileStringA, WriteFile, ReadFile, MulDiv, SetFilePointer, FindClose, FindNextFileA, FindFirstFileA, DeleteFileA, CopyFileA

> ole32.dll: OleInitialize, OleUninitialize, CoCreateInstance

> shell32.dll: SHGetMalloc, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA, SHGetSpecialFolderLocation

> user32.dll: ScreenToClient, GetWindowRect, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, EndDialog, AppendMenuA, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxA, CharPrevA, DispatchMessageA, PeekMessageA, CreateDialogParamA, DestroyWindow, SetTimer, SetWindowTextA, PostQuitMessage, SetForegroundWindow, wsprintfA, SendMessageTimeoutA, FindWindowExA, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, TrackPopupMenu, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongA, LoadImageA, GetDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndPaint, ShowWindow

> version.dll: GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA



( 0 exports )

TrID : File type identification

Win32 Executable MS Visual C++ (generic) (65.2%)

Win32 Executable Generic (14.7%)

Win32 Dynamic Link Library (generic) (13.1%)

Generic Win/DOS Executable (3.4%)

DOS Executable Generic (3.4%)

ThreatExpert: http://www.threatexpert.com/report.aspx?md5=2b8f5a693275102ae1d48fc138685c80

ssdeep: 12288:UZCcXWfBaK+c7xEjQRPKyTxp3CMGbd/lmT+iOX8mA63Zp0vQR7q7VCeaE:UZCkAF+cW017yM2dlo+d8mb70v2+7VCW

PEiD : -

packers (Kaspersky): PE_Patch

RDS : NSRL Reference Data Set



I did NOT remove, modify, added something @ this tool. Using is on your own risk.