Security Incidents mailing list archives
Can anyone identify this backdoor?
From: "Matt Andreko" <mandreko () ori net>
Date: Wed, 10 Jul 2002 16:58:06 -0500
Apparently over the holiday, one of my client's machines was broken into. It was running Windows 2000 Pro, with IIS installed (webserver only, no ftp,smtp..) Apparently the attacker got in through this. The logs show some Unicode in the requests, so I'd bet that's it. A file was deposited in the c:\winnt\system32\ folder named "cc.exe". I have studied it a little bit, and it seems quite interesting. It's actually a winrar self-executable file. Inside contains what I believe a stripped down copy of serv-u ftp server, messages for that server, and some other interesting tools. There's a cmd.exe file, which doesn't match the size of the one in c:\winnt\system32, so it could be backdoored. I was basically wondering if anyone had seen anything like it, or could identify it. I have put a copy up temporarily on my webserver at http://www.criminalsmostly.com/~mandreko/cc.zip ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
Current thread:
- Can anyone identify this backdoor? Matt Andreko (Jul 10)
- Re: Can anyone identify this backdoor? David Jacoby (Jul 11)
- Re: Can anyone identify this backdoor? Ryan Russell (Jul 11)
- RE: Can anyone identify this backdoor? Matt Andreko (Jul 11)
- Re: Can anyone identify this backdoor? Matt Scarborough (Jul 12)
- Re: Can anyone identify this backdoor? shawn merdinger (Jul 11)
- RE: Can anyone identify this backdoor? Erick Arturo Perez Huemer (Jul 11)
- RE: Can anyone identify this backdoor? Richard Bartlett (Jul 11)
- RE: Can anyone identify this backdoor? Ian Webb (Jul 22)
- Re: Can anyone identify this backdoor? Mark Shirley (Jul 12)
- <Possible follow-ups>
- Re: Can anyone identify this backdoor? Jhon Q Doe (Jul 11)
(Thread continues...)
- Re: Can anyone identify this backdoor? David Jacoby (Jul 11)