4 ms·

Source code of the worm: https://pastebin.com/raw/EKdKamFq https://pastebin.com/raw/EKdKamFq Edit: How I got this: Someone on reddit went to their site when i

Source code of the worm: https://pastebin.com/raw/EKdKamFq https://pastebin.com/raw/EKdKamFq Edit: How I got this: Someone on reddit went to their site when it wasn't down, and downloaded the files linked in the page's HTML. I just posted it here. This isn't the full source code. There was another PHP file visible on their website that unfortunately isn't visible anymore.

FreezerburnV 9y ago
Where'd you get this?
ben174 9y ago
Sending everything to this mailinator address which oddly seems to be empty: https://www.mailinator.com/inbox2.jsp?public_to=hhhhhhhhhhhhhhhh#/#public_maildirdiv https://www.mailinator.com/inbox2.jsp?public_to=hhhhhhhhhhhh... Maybe Mailinator has purged the box and is rejecting mail from it. Good on them.
- justusthane 9y ago
  Please correct me if I'm wrong, but I don't think anything was being sent to that mailinator address. From looking at both that source code and emails received by my users, the mailinator address seems to be only in the message header "to" field, which, AFAIK, doesn't do anything other than display in the mail client. The actual recipient's address is in the envelope recipient field. I don't understand what the purpose of that mailinator address was.
  - evan_ 9y ago
    It sends an email to that mailinator address, with all of the contacts BCC'd. mailinator shut it down very quickly but emails definitely went to that address.
ficklepickle 9y ago
They even used Google analytics! UA-98290545-1
jameslk 9y ago
I like how the code has Javadoc comments, in case other developers need to maintain the worm or use its public API.
- ben_jones 9y ago
  That's gotta be a copy-paste job. If someone was actually cheeky enough to comment their malware they would've left jokes, puns, etc.
  - jshmrsn 9y ago
    Indeed, those comments come from a Google Analytics quick start: https://github.com/chriskwan/gmailytics/blob/master/quickstart.html https://github.com/chriskwan/gmailytics/blob/master/quicksta...
  - justusthane 9y ago
    Copy/pasted from this Stack Overflow answer: http://stackoverflow.com/a/37342136/300887 http://stackoverflow.com/a/37342136/300887

FreezerburnV 9y ago

Where'd you get this?

ben174 9y ago

Sending everything to this mailinator address which oddly seems to be empty: https://www.mailinator.com/inbox2.jsp?public_to=hhhhhhhhhhhhhhhh#/#public_maildirdiv https://www.mailinator.com/inbox2.jsp?public_to=hhhhhhhhhhhh... Maybe Mailinator has purged the box and is rejecting mail from it. Good on them.

justusthane 9y ago
Please correct me if I'm wrong, but I don't think anything was being sent to that mailinator address. From looking at both that source code and emails received by my users, the mailinator address seems to be only in the message header "to" field, which, AFAIK, doesn't do anything other than display in the mail client. The actual recipient's address is in the envelope recipient field. I don't understand what the purpose of that mailinator address was.
- evan_ 9y ago
  It sends an email to that mailinator address, with all of the contacts BCC'd. mailinator shut it down very quickly but emails definitely went to that address.

ficklepickle 9y ago

They even used Google analytics! UA-98290545-1

jameslk 9y ago

I like how the code has Javadoc comments, in case other developers need to maintain the worm or use its public API.

ben_jones 9y ago
That's gotta be a copy-paste job. If someone was actually cheeky enough to comment their malware they would've left jokes, puns, etc.
- jshmrsn 9y ago
  Indeed, those comments come from a Google Analytics quick start: https://github.com/chriskwan/gmailytics/blob/master/quickstart.html https://github.com/chriskwan/gmailytics/blob/master/quicksta...
- justusthane 9y ago
  Copy/pasted from this Stack Overflow answer: http://stackoverflow.com/a/37342136/300887 http://stackoverflow.com/a/37342136/300887