[Emerging-Sigs] VB WinHTTP User Agent alerts

[Matt Jonkman]

We could make an exception for dell.com, but I think more folks would be 
interested to know what their systems are doing. Maybe more of them bug 
Dell and Why The F did you load my computer with crap that contacts you 
everyday, and what's it sending? And when did you ask my permission for 
this....

Matt

Jack Pepper wrote:
> sid=2002970
> 
> 192.168.10.154	 MALWARE VB WinHTTP User Agent - Possible Malware
> 
> 
> That WinHTTP alert is cause by some new software that DELL is  
> preloading on their computers.   It appears to be uploading hardware  
> configuration data once per day.
> 
> 
> 12:21:50.345343 IP 192.168.10.154.1330 > 12.129.31.109.80: P  
> 1584357475:1584357908(433) ack 1809964304 win 64860
> 0x0000   4500 01d9 48b8 4000 8006 b936 c0a8 0a9a        E...H. at ....6....
> 0x0010   0c81 1f6d 0532 0050 5e6f 6063 6be1 dd10        ...m.2.P^o`ck...
> 0x0020   5018 fd5c 0a83 0000 504f 5354 202f 7364        P..\....POST./sd
> 0x0030   6378 7573 6572 2f61 7370 2f64 656c 6c70        cxuser/asp/dellp
> 0x0040   726f 6669 6c65 696e 666f 2e61 7370 2048        rofileinfo.asp.H
> 0x0050   5454 502f 312e 310d 0a43 6f6e 7465 6e74        TTP/1.1..Content
> 0x0060   2d74 7970 653a 2061 7070 6c69 6361 7469        -type:.applicati
> 0x0070   6f6e 2f78 2d77 7777 2d66 6f72 6d2d 7572        on/x-www-form-ur
> 0x0080   6c65 6e63 6f64 6564 0d0a 436f 6e74 656e        lencoded..Conten
> 0x0090   742d 4c65 6e67 7468 3a20 3137 310d 0a41        t-Length:.171..A
> 0x00a0   6363 6570 743a 202a 2f2a 0d0a 5573 6572        ccept:.*/*..User
> 0x00b0   2d41 6765 6e74 3a20 4d6f 7a69 6c6c 612f        -Agent:.Mozilla/
> 0x00c0   342e 3020 2863 6f6d 7061 7469 626c 653b        4.0.(compatible;
> 0x00d0   2057 696e 3332 3b20 5769 6e48 7474 702e        .Win32;.WinHttp.
> 0x00e0   5769 6e48 7474 7052 6571 7565 7374 2e35        WinHttpRequest.5
> 0x00f0   290d 0a48 6f73 743a 2077 7777 2e64 656c        )..Host:.www.del
> 0x0100   6c73 7570 706f 7274 6365 6e74 6572 2e63        lsupportcenter.c
> 0x0110   6f6d 0d0a 436f 6e6e 6563 7469 6f6e 3a20        om..Connection:.
> 0x0120   4b65 6570 2d41 6c69 7665 0d0a 0d0a 636c        Keep-Alive....cl
> 0x0130   6965 6e74 5f67 7569 643d 3433 3833 6664        ient_guid=4383fd
> 0x0140   6433 2d30 3732 382d 3437 3364 2d61 3635        d3-0728-473d-a65
> 0x0150   352d 3031 6664 6435 3936 3930 6130 2673        5-01fdd59690a0&s
> 0x0160   6572 7669 6365 5f74 6167 3d34 5651 5351        ervice_tag=4VQSQ
> 0x0170   4231 266d 6f64 656c 3d58 5053 204d 3132        B1&model=XPS.M12
> 0x0180   3130 266c 6f62 3d58 5053 2673 6567 6d65        10&lob=XPS&segme
> 0x0190   6e74 3d32 3926 636f 756e 7472 793d 7573        nt=29&country=us
> 0x01a0   2672 6567 696f 6e3d 5553 2663 6c69 656e        &region=US&clien
> 0x01b0   745f 6c61 6e67 7561 6765 3d65 6e26 7761        t_language=en&wa
> 0x01c0   7272 616e 7479 5f65 7870 5f64 6174 653d        rranty_exp_date=
> 0x01d0   392f 3130 2f32 3030 39                         9/10/2009
> 

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc