Re: Interesting little piece of malware...
"Matthew Sowers" <[email protected]>
| Newsgroups | gmane.comp.security.intrusions |
|---|---|
| Message-ID | <[email protected]> |
Seems to me to be Rbot or something very similar. Maybe Rxbot. And it's using the dcom exploit one of the kiddies new favorites right now. It's not malware, somewhere along the line you guys got rooted. Rbot is one of the favorites now I have a couple of them if you would like to take a look at them to see where it installs itself so you could get an idea of where its located. ----- Original Message ----- From: Andrew Daviel<mailto:[email protected]> To: Intrusions List<mailto:[email protected]> Sent: Wednesday, September 15, 2004 12:28 AM Subject: Re: [Intrusions] Interesting little piece of malware... On Tue, 11 May 2004, Jim Becher wrote: > > On a couple of machines today (started first thing this morning), I started > noticing Welchia type scanning (local class B preference, port 135, etc). I > also noticed some IRC command and control traffic from the machines that > were responsible for the scanning. The scanning activity were all from were > all WinXP and Win2K machines. Symantec anti-virus running, updated sigs in > the last few days. Symantec wasn't flagging anything. We have seen something similar here, though I don't have any details on the infected machines at this point (shut down 3 and worked on #4, but it turned out to be an unrelated problem). There was traffic to an IRC server in Taiwan (210.240.39.17). I think it uas used as a reporting venue. Traffic included things like: JOIN #ur omfw Random Port Scan started on Y.Y.x.x:135 with a delay of 5 seconds for 0 minutes using 100 threads. PRIVMSG #ur :[Dcom135]: Exploiting IP: nnn.nnn.nnn.nnn :[mtr]|496289!~sdhnmjf@=42ml-45.xxxxx.xx.com PRIVMSG #ur :[TFTP]: File transfer complete to IP: nnn.nnn.nnn.nnn (C:\WINDOWS\System32\MSupdate.exe). This seemed to start up sometime this morning I think; at least, we noticed the local traffic setting off alarms then. The IRC server appeared to be running on a Windows machine used as a webserver; Chinese text, no english. I haven't tried contacting them yet. -- Andrew Daviel, TRIUMF, Canada Tel. +1 (604) 222-7376 [email protected]<mailto:[email protected]> _______________________________________________ Intrusions mailing list [email protected]<mailto:[email protected]> http://www.dshield.org/mailman/listinfo/intrusions<http://www.dshield.org/mailman/listinfo/intrusions> _______________________________________________ Intrusions mailing list [email protected] http://www.dshield.org/mailman/listinfo/intrusions