I found a file of unknown origin on a server called /var/tmp/f01bdc03. It was entered in root crontab to run every 10 minutes. So I made a VM and ran the program with strace. The only outside connection it made was to 18.104.22.168 which one IP site said was in Hanoi. Anyway, the messages the mystery program sent to Hanoi are like:
NICK RT-WEBM-x86_64-e138231a-XRBRTQ\n USER Linux localhost localhost :localhost.localdomain 3.10.0-514.el7.x86_64 #1 SMP Tue Nov 22 16:42:41 UTC 2016 NOTICE AUTH :*** Looking up your hostname... :th0m.production.net 001 RT-WEBM-x86_64-e138231a-XRBRTQ :this is th0m.production.net you are RT-WEBM-x86_64-e138231a-XRBRTQ! Linux@<<reversed-lookup-name-for-my-outside-address>>\r\n :th0m.production.net 005 RT-WEBM-x86_64-e138231a-XRBRTQ CHANTYPES=&# EXCEPT MODE RT-WEBM-x86_64-e138231a-XRBRTQ -xi\n JOIN #TM :bleh\n :th0m.production.net NOTICE RT-WEBM-x86_64-e138231a-XRBRTQ :Setting/removing of usermode(s) 'x' has been disabled.\r\n
Does this look familiar to anyone?