Re: Can anyone identify this backdoor?

From: shawn merdinger (shawnmerat_private)
Date: Thu Jul 11 2002 - 01:06:51 PDT

  • Next message: Erick Arturo Perez Huemer: "RE: Can anyone identify this backdoor?"

    Running strings on the file shows some interesting stuff.
    :
    1.  Executables:
    
    recycler\iissrvs.exe
    recycler\nc.exe 
    info.exe
    recycler\CMD.EXE
    recycler\hk.exe
    recycler\JAsfv.exe
    recycler\tlist.exe  
    
    
    2.  Files:
    
    recycler\Localstart.cnf
    recycler\iisl.dll
    recycler\JAsfv.ini
    recycler\JAsfv.dll
    
    
    3.  Commands?:
    
    recycler\iis.dll- [ Espace Libre: %Dfree Mo ] - [ BP: %ServerKBps Kb/sec ] 
    
    Also, how were you able to conduct analysis on this executable?  What 
    tools did you use?  Do you have any resource suggestions for learning how 
    to do this type of analysis?
    
    Thanks,
    
    -scm
    
    
    MA:Matt Andreko
    
    MA>Apparently over the holiday, one of my client's machines was broken
    MA>into.  It was running Windows 2000 Pro, with IIS installed (webserver
    MA>only, no ftp,smtp..)  Apparently the attacker got in through this.  The
    MA>logs show some Unicode in the requests, so I'd bet that's it.  
    MA>
    MA>A file was deposited in the c:\winnt\system32\ folder named "cc.exe".  I
    MA>have studied it a little bit, and it seems quite interesting.  It's
    MA>actually a winrar self-executable file.  Inside contains what I believe
    MA>a stripped down copy of serv-u ftp server, messages for that server, and
    MA>some other interesting tools.  There's a cmd.exe file, which doesn't
    MA>match the size of the one in c:\winnt\system32, so it could be
    MA>backdoored.
    MA>
    MA>I was basically wondering if anyone had seen anything like it, or could
    MA>identify it.  I have put a copy up temporarily on my webserver at
    MA>http://www.criminalsmostly.com/~mandreko/cc.zip 
    MA>
    MA>
    MA>
    MA>
    MA>
    MA>
    MA>
    MA>
    MA>----------------------------------------------------------------------------
    MA>This list is provided by the SecurityFocus ARIS analyzer service.
    MA>For more information on this free incident handling, management 
    MA>and tracking system please see: http://aris.securityfocus.com
    MA>
    
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Thu Jul 11 2002 - 15:42:34 PDT