11

I found several lines of this request in my web server access log:

Source IP       Dest IP Request                                                                 Stat User agent
217.172.190.19  1.2.3.4 POST /?cmd=info&key=a7aa3875fc4422ca78f7b4216205b9a5&ip=1.2.3.4 HTTP/1.1 200 Net-Worm.PHP.Mongiko.a

Tried to Google, but found no information. What is Net-Worm.PHP.Mongiko and what is it trying to post on my website?

  • 5
    Malware which sends an honest user-agent string? That's really odd. Is that really the string it sends or is your web access log tool adding this on its own? – Philipp Feb 22 '15 at 14:47
  • 1
    That is most probably no malware. I really doubt any sane person would use an AV database virus designation in his request user-agents. On the other hand, remembering all the malware authors who never code when sober, the thing being malware could seem at least plausible. – Mints97 Feb 22 '15 at 16:46
  • @Philipp tools for script kiddies often send honest user-agent to ensure those stupid lamers cannot do much damage. It's a sort of 1337 revenge ;) – Stefano Sanfilippo Feb 25 '15 at 17:26
4

This virus alert is a scam. The goal is to get admins to download and execute special "removal tools", which are in fact the actual virus.

Another note about how websites work and what you see in the access log: You can go to basically every website and append arbitrary parameters like ?cmd=foo&key=bar and the website will just load and ignore the parameter. This suspicious log entry may not mean anything at all!

Monitor your system closely to see if your it is indeed doing something fishy. E.g., by logging all HTTP traffic containing suspicious parameters.

The removal tool as advertised (There's a link in the comments - do not install), will open your firewall and allow an attacker to remote control your machine.

I recommend you also watch the thread following this freebsd-security mailing list post, if you want to know more.

  • 2
    For the aspiring reverse engineers: A suspicious removal tool (that is likely malware) can be found on hXXp://rkcheck.org/index.html (this link is intentionally broken. Do not install their software.) – freddyb Feb 25 '15 at 20:52
  • 2
    This is basically confirmed. It's fake. The removal tool is the actual malware. – Ariel Feb 25 '15 at 22:19
  • Thanks, I updated my answer. Feel free to edit right away, in the future! – freddyb Feb 27 '15 at 15:15
3

As freddyb said, this seems to be a scam. I looked at the "removal tool" for the virus - it contains an executable that forks off into the background, renames itself to udevd, connects to 95.215.44.195:443 (that server seems to be down atm), sends the string FOG\n\n# and gives the server a reverse shell (by dup()ing the socket to fds 0,1,2, then executing the shell - this means that the server can then run arbitrary code on your computer). There is no way that that's a legit malware removal tool.

1

It looks like that's trying to communicate with a previously-installed program. I'd guess (from cmd=info) that it's trying to see if install was completed. ip=1.2.3.4 (which I assume is your IP anonymized) is telling it what IP it is trying to talk to, in case the traffic would come back from another IP.

It's probably nothing, just a scanner for some bit of malware. As long as your server doesn't respond positively you're fine.

0

This IP address is showing at present via i2p in the TOR browser. Somebody is using an anonymous network to get some sort of information from your server, and probably also has code there to send other commands to it.

  • I'd say it actually does. – Jens Erat Feb 23 '15 at 9:12

protected by Community Feb 25 '15 at 17:13

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.