Re: Trojan found on Linux server

[Bulgaria Online - Assen Totin <assen () online bg>]

Hi all,

> http://www.jeremygaddis.com/files/ummtodkhk.

A quick test shows that the process forks, then opens an IRC session to
64.239.9.236 port 3434 (there are also two others hard-coded IP
addresses inside the binary, 219.133.46.212 and 61.211.239.84) -
probably a password protected server, the agent issues these commands:

PASS f9dsa
USER mbopaidgb
NICK cmktvjopr

Probably stays logged there, expecting remote commands. Seems capable of
spawning a shell on the infected machine. The "crontab" solution is
quite interesting, however. But even more interesting is how the
infection spreads... if it came through Apache, can you suggest version
and configuration (is there PHP, for example; is any file upload
permitted etc.)

Happy hunting,

Assen Totin
Development Manager

-- 
===============================
       BULGARIA ONLINE
  Your quality... Your price!
===============================
   ++ 359 2 9733000 ext. 511
     http://home.online.bg


---------------------------------------------------------------------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management 
education and the case study affords you unmatched consulting experience. 
Tailor your education to your own professional goals with degree 
customizations including Emergency Management, Business Continuity Planning, 
Computer Emergency Response Teams, and Digital Investigations. 

http://www.msia.norwich.edu/secfocus
----------------------------------------------------------------------------