Rule: 

--
Sid: 
3063

-- 
Summary: 
This event is generated when an attempt is made to request a connection using
the Vampire 1.2 trojan.

-- 
Impact: 
If connected, the attacker could execute a multitude of functions resulting in a
complete compromise of the victim's machine.

--
Detailed Information:
Vampire 1.2 uses port 1020 by default. This port cannot be changed by the attacker. 

The following is a list of the commands for many of Vampier 1.2's functions
(Command Name: Command String):

Chat With Victim: chat
Clear Recent Folder: cleardoc
Close Windows: endwin
Corrupt File: currfile
Crazy Mouse: crazy
Delete Directory: deletedir
Delete File: delete
Disk Space Left: space
Disable CTRL-ALT-DEL: ctrldisable
Enable CTRL-ALT-DEL: ctrlenable
Fill Hard Drive: fillhd
Find File: findfiles
Format: format
Get Active Windows: getact
Get ICQ Number: geticq
Get Local Time: gettime
Get Operating System: getos
Get Server Path: getpath
Get System Owner: getowner
Get Temp Directory: gettemp
Get Windows Directory: getwin
Get Current User: getname
Get Disk Serial Number: getserial
Get Hard Drive: gethd
Get Organization: getorg
Hang Up Modem: hangup
ISP Account Info: ispinfo
Kill Window: killtask\
Logoff: logoff
Make Directory: makedir
Monitor Off: monitoroff
Monitor On: monitoron
Hide Mouse: hidemouse
Show Mouse: showmouse
Open Control Panel: panel
Open Date And Time: date
Open CD-ROM: cdopen
Close CD-ROM: cdclose
Open URL: www\
Ping: ping
Read A Drive: reada
Reboot: reboot
Kill Registry: regfuck
Run Program: run
Screenshot: screenshot
Send Keys: text
Send Message: sndmsg
Set Computer Name: pcname
Set Volume Label: setvolumelabel
Shutdown: shutdown
Hide Task Bar: hidetask
Show Task Bar: showtask
Wacky CR-ROM: wackycd
--
Affected Systems:
Windows 95/98/ME

--

Attack Scenarios: 
The victim must first install the server. Be wary of suspicious files because
they often can be backdoors in disguise.
Once the victim mistakenly installs the server program, the attacker usually
will employ an IP scanner program
to find the IP addresses of victims that have installed the program. Then the
attacker enters the IP address and 
presses the connect button and he has access to your computer.

-- 

Ease of Attack: 
Easy. Simply a matter of pressing the connect button once the victim has
installed the server.


-- 

False Positives:
None known

--
False Negatives:
None known

-- 

Corrective Action: 
In order to get rid of it, you must kill the following processes:
vampire.exe or (if not there) server.exe

You must delete the following files from your hard drive:
vampire.exe or (if not there) server.exe

Keep your anti-virus software updated.

--
Contributors:
Original Rule Writer: Ricky Macatee <rmacatee@sourcefire.com> 
Sourcefire Research Team

-- 
Additional References:

Pestpatrol:
http://www.pestpatrol.com/pestinfo/v/vampire_1_2.asp

Dark-E:
http://www.dark-e.com/archive/trojans/vampire/index.shtml

--
