Out of curiosity I found this, were they discuss the analysis of a malware attack.
About fake and fuck, often attackers load up tools to facilitate their work.
About fake.cfg, there is indeed an util in Linux called fake.
$apt-cache search fake | grep ^fake
fake - IP address takeover tool
Fake is a utility that enables the IP address be taken over by
bringing up a second interface on the host machine and using
gratuitous arp. Designed to switch in backup servers on a LAN.
So I do suspect fake could be a way of:
- evading firewall rules;
- reaching to other networks;
- generating packets/spam using multiple IPs of your network at a time to evade blacklists/fail2ban/apache mod evasive when attacking other servers in the Internet at large.
As for fuck, the objectives are less clear.
I found this:
Magnificent app which corrects your previous console command.
The fuck command uses rules substitution to run the previous command with modifications. I am supposing here that it is used as a basic tool to automate/obfuscate in history/monitoring some of the actual commands run by the attackers.
In addition to debuggers that others already mentioned, to follow up their activity, I do recommend using
dtrace4linux. They are fantastic tools to follow up the nitty gritty of kernel calls.
For following up all files opened in the compromised I/O, you run:
sysdig -p "%12user.name %6proc.pid %12proc.name %3fd.num %fd.typechar %fd.name" evt.type=open
Snoop file opens as they occur (with sysdig)
Sysdig has the ability to show everything, including buffers of files being written, or data sent over the network.
Needless to say, you should backup and isolate the server before running those commands.