I found a file of unknown origin on a server called /var/tmp/f01bdc03. It was entered in root crontab to run every 10 minutes. So I made a VM and ran the program with strace. The only outside connection it made was to which one IP site said was in Hanoi. Anyway, the messages the mystery program sent to Hanoi are like:

NICK RT-WEBM-x86_64-e138231a-XRBRTQ\n
USER Linux localhost localhost :localhost.localdomain 3.10.0-514.el7.x86_64 #1 SMP Tue Nov 22 16:42:41 UTC 2016

NOTICE AUTH :*** Looking up your hostname...

:th0m.production.net 001 RT-WEBM-x86_64-e138231a-XRBRTQ 
:this is th0m.production.net you are RT-WEBM-x86_64-e138231a-XRBRTQ!
:th0m.production.net 005 RT-WEBM-x86_64-e138231a-XRBRTQ CHANTYPES=&# EXCEPT

MODE RT-WEBM-x86_64-e138231a-XRBRTQ -xi\n

JOIN #TM :bleh\n

:th0m.production.net NOTICE RT-WEBM-x86_64-e138231a-XRBRTQ :Setting/removing of usermode(s) 'x' has been disabled.\r\n

Does this look familiar to anyone?

  • You might want to contact some professionals sooner than later, depending on how valuable the target is.
    – user163495
    Oct 9, 2019 at 14:29
  • the comes from the mystery file doing a DNS lookup of wwww.omfg.pw which is registered by namecheap.com and namecheap doesn't show who has omfg.pw registered Oct 9, 2019 at 15:03
  • I think it came from this: rapid7.com/db/vulnerabilities/… Oct 10, 2019 at 13:02

1 Answer 1


That's indeed malware. The protocol is IRC, which it's using for its command-and-control.

  • Irc? Where is coming IRC here?
    – peterh
    Oct 9, 2019 at 15:05
  • 4
    "NOTICE AUTH :*** Looking up your hostname..." => typical message from IRC server. "JOIN #TM :bleh\n" => IRC command to join a channel.
    – binarym
    Oct 9, 2019 at 15:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .