0

I found a file of unknown origin on a server called /var/tmp/f01bdc03. It was entered in root crontab to run every 10 minutes. So I made a VM and ran the program with strace. The only outside connection it made was to 137.74.146.42 which one IP site said was in Hanoi. Anyway, the messages the mystery program sent to Hanoi are like:

NICK RT-WEBM-x86_64-e138231a-XRBRTQ\n
USER Linux localhost localhost :localhost.localdomain 3.10.0-514.el7.x86_64 #1 SMP Tue Nov 22 16:42:41 UTC 2016

NOTICE AUTH :*** Looking up your hostname...

:th0m.production.net 001 RT-WEBM-x86_64-e138231a-XRBRTQ 
:this is th0m.production.net you are RT-WEBM-x86_64-e138231a-XRBRTQ!
Linux@<<reversed-lookup-name-for-my-outside-address>>\r\n
:th0m.production.net 005 RT-WEBM-x86_64-e138231a-XRBRTQ CHANTYPES=&# EXCEPT

MODE RT-WEBM-x86_64-e138231a-XRBRTQ -xi\n

JOIN #TM :bleh\n

:th0m.production.net NOTICE RT-WEBM-x86_64-e138231a-XRBRTQ :Setting/removing of usermode(s) 'x' has been disabled.\r\n

Does this look familiar to anyone?

Improve this question
3
  • You might want to contact some professionals sooner than later, depending on how valuable the target is.
    – user163495
    Oct 9, 2019 at 14:29
  • the 137.74.146.42 comes from the mystery file doing a DNS lookup of wwww.omfg.pw which is registered by namecheap.com and namecheap doesn't show who has omfg.pw registered
    – Mike Rieker
    Oct 9, 2019 at 15:03
  • I think it came from this: rapid7.com/db/vulnerabilities/…
    – Mike Rieker
    Oct 10, 2019 at 13:02

1 Answer 1

Reset to default
5

That's indeed malware. The protocol is IRC, which it's using for its command-and-control.

Improve this answer
2
  • Irc? Where is coming IRC here?
    – peterh
    Oct 9, 2019 at 15:05
  • 4
    "NOTICE AUTH :*** Looking up your hostname..." => typical message from IRC server. "JOIN #TM :bleh\n" => IRC command to join a channel.
    – binarym
    Oct 9, 2019 at 15:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.