0

I found a file of unknown origin on a server called /var/tmp/f01bdc03. It was entered in root crontab to run every 10 minutes. So I made a VM and ran the program with strace. The only outside connection it made was to 137.74.146.42 which one IP site said was in Hanoi. Anyway, the messages the mystery program sent to Hanoi are like:

NICK RT-WEBM-x86_64-e138231a-XRBRTQ\n
USER Linux localhost localhost :localhost.localdomain 3.10.0-514.el7.x86_64 #1 SMP Tue Nov 22 16:42:41 UTC 2016

NOTICE AUTH :*** Looking up your hostname...

:th0m.production.net 001 RT-WEBM-x86_64-e138231a-XRBRTQ 
:this is th0m.production.net you are RT-WEBM-x86_64-e138231a-XRBRTQ!
Linux@<<reversed-lookup-name-for-my-outside-address>>\r\n
:th0m.production.net 005 RT-WEBM-x86_64-e138231a-XRBRTQ CHANTYPES=&# EXCEPT

MODE RT-WEBM-x86_64-e138231a-XRBRTQ -xi\n

JOIN #TM :bleh\n

:th0m.production.net NOTICE RT-WEBM-x86_64-e138231a-XRBRTQ :Setting/removing of usermode(s) 'x' has been disabled.\r\n

Does this look familiar to anyone?

|improve this question
  • You might want to contact some professionals sooner than later, depending on how valuable the target is. – MechMK1 Oct 9 at 14:29
  • the 137.74.146.42 comes from the mystery file doing a DNS lookup of wwww.omfg.pw which is registered by namecheap.com and namecheap doesn't show who has omfg.pw registered – Mike Rieker Oct 9 at 15:03
  • I think it came from this: rapid7.com/db/vulnerabilities/… – Mike Rieker Oct 10 at 13:02
5

That's indeed malware. The protocol is IRC, which it's using for its command-and-control.

|improve this answer
  • Irc? Where is coming IRC here? – peterh says reinstate Monica Oct 9 at 15:05
  • 4
    "NOTICE AUTH :*** Looking up your hostname..." => typical message from IRC server. "JOIN #TM :bleh\n" => IRC command to join a channel. – binarym Oct 9 at 15:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.