full-disclosure - Re: Trojan found on Linux server

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1136377590.3386.27.camel@life.ntdomain.online.bg>
Date: Wed Jan  4 13:26:42 2006
From: assen at online.bg (Bulgaria Online - Assen Totin)
Subject: Re: Trojan found on Linux server

Hi all,

> http://www.jeremygaddis.com/files/ummtodkhk.

A quick test shows that the process forks, then opens an IRC session to
64.239.9.236 port 3434 (there are also two others hard-coded IP
addresses inside the binary, 219.133.46.212 and 61.211.239.84) -
probably a password protected server, the agent issues these commands:

PASS f9dsa
USER mbopaidgb
NICK cmktvjopr

Probably stays logged there, expecting remote commands. Seems capable of
spawning a shell on the infected machine. The "crontab" solution is
quite interesting, however. But even more interesting is how the
infection spreads... if it came through Apache, can you suggest version
and configuration (is there PHP, for example; is any file upload
permitted etc.)

Happy hunting,

Assen Totin
Development Manager

-- 
===============================
       BULGARIA ONLINE
  Your quality... Your price!
===============================
   ++ 359 2 9733000 ext. 511
     http://home.online.bg