Full Disclosure mailing list archives

Re: SSH scans, i caught one

From: "OrderZero" <orderzero () hushmail com>
Date: Fri, 19 Nov 2010 15:11:31 -0500

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Looks like the syslgd is your average botnet, simply connects to an
irc for cnc, from strings...

WHO@^NICKªH^@c^_Ã¬{JOIN^_:^ONULL^GOÃ¾Ã¿>^f3ÂµT%9:unable to
resolveÃ?`Ã;#spoofs:

where #spoofs could be the channel, no cleartext server however
(other than a conspicuous string "nubnet")..a disassembly of said
syslgd is attached...
-----BEGIN PGP SIGNATURE-----
Charset: UTF8
Version: Hush 3.0
Note: This signature can be verified at https://www.hushtools.com/verify

wpwEAQMCAAYFAkzm2fMACgkQrjINwNSSxTmv5QQAsqzdllWlmbF0aZ/jH94lrEwJ5p2c
IJraL7sSIu/7kZ3TQqvUk86qzoKMrHjGevMCu344FDh9GVVPdRcuAaPA8cPpjN5Dx/Pu
8vatgtsxJKT4h0penXNnuHZqgwZdLnY1Ez6Ms3CydCRuOqemas+vp2cRZxkEKcnnF8bI
CXijAkw=
=Ytpg
-----END PGP SIGNATURE-----

Attachment: disas_syslgd.txt
Description:

Attachment: disas_syslgd.txt.sig
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Current thread:

SSH scans, i caught one Marco van Berkum (Nov 19)
- Re: SSH scans, i caught one Alan Buxey (Nov 19)
  - Re: SSH scans, i caught one Marco van Berkum (Nov 19)
    - Re: SSH scans, i caught one Julien Reveret (Nov 19)
    - Re: SSH scans, i caught one Marco van Berkum (Nov 19)
    - Re: SSH scans, i caught one Marco van Berkum (Nov 19)
- Re: SSH scans, i caught one Danijel (Nov 20)
  - Re: SSH scans, i caught one Marco van Berkum (Nov 19)
- <Possible follow-ups>
- Re: SSH scans, i caught one OrderZero (Nov 20)
  - Re: SSH scans, i caught one Marco van Berkum (Nov 20)
    - Re: SSH scans, i caught one Robin (Nov 20)
    - Re: SSH scans, i caught one Marco van Berkum (Nov 20)
    - Re: SSH scans, i caught one Egon Alter (Nov 20)
    - Re: SSH scans, i caught one Marco van Berkum (Nov 20)
    - Re: SSH scans, i caught one Marco van Berkum (Nov 20)
    - Message not available
    - Re: SSH scans, i caught one Thor (Hammer of God) (Nov 22)
    - Message not available
    - Re: SSH scans, i caught one Graham Gower (Nov 22)
    - Re: SSH scans, i caught one Valdis . Kletnieks (Nov 22)
    - Re: SSH scans, i caught one Marco van Berkum (Nov 22)

(Thread continues...)