4

I am not asking what to do with an compromised box. Specifically, I am asking if anybody has experience with hack/malware amongst other files leaves files "/usr/bin/fake.cfg" and "/usr/bin/fuck". I can see in part what it is doing and how. I realize the most appropriate course of action is to disconnect from internet, salvage, rebuild.

I am curious to learn more about this particular incursion. I do not often get hacked or find myself on compromised machines - that I have this opportunity I would like to turn it into a learning opportunity.

Does anybody have and experience with this particular incursion? Any suggestions where I might look.

A million years ago the FBI used to keep a useful database of this sort of thing. Since 911 it has become pretty useless.

Ideas?

  • 2
    Have you tried running chkrootkit/rkhunter ? – Bratchley Jan 17 '16 at 2:16
  • Yeah seriously that is what caught my attention. It's a long story but the day2day of the box is not really my responsibility. I knew there was something amiss - and I found that running. – terary Jan 17 '16 at 3:20
4

Out of curiosity I found this, were they discuss the analysis of a malware attack.

http://remchp.com/blog/?p=52

About fake and fuck, often attackers load up tools to facilitate their work.

About fake.cfg, there is indeed an util in Linux called fake.

$apt-cache search fake | grep ^fake
fake - IP address takeover tool 

Fake is a utility that enables the IP address be taken over by bringing up a second interface on the host machine and using gratuitous arp. Designed to switch in backup servers on a LAN.

So I do suspect fake could be a way of:
- evading firewall rules;
- reaching to other networks;
- generating packets/spam using multiple IPs of your network at a time to evade blacklists/fail2ban/apache mod evasive when attacking other servers in the Internet at large.

As for fuck, the objectives are less clear.

I found this:

https://github.com/nvbn/thefuck

Magnificent app which corrects your previous console command.

The fuck command uses rules substitution to run the previous command with modifications. I am supposing here that it is used as a basic tool to automate/obfuscate in history/monitoring some of the actual commands run by the attackers.

In addition to debuggers that others already mentioned, to follow up their activity, I do recommend using strace, sysdig or dtrace4linux. They are fantastic tools to follow up the nitty gritty of kernel calls.

For following up all files opened in the compromised I/O, you run:

sysdig -p "%12user.name %6proc.pid %12proc.name %3fd.num %fd.typechar %fd.name" evt.type=open

Snoop file opens as they occur (with sysdig)

From:

http://www.sysdig.org/wiki/sysdig-examples/

Sysdig has the ability to show everything, including buffers of files being written, or data sent over the network.

Needless to say, you should backup and isolate the server before running those commands.

  • Oh - yeah. The 'fuck' program is not the same as the 'thefuck'. The purpose of 'thefuck' was not clear to me either. However 'fuck' was written at the same exact time as the other malicious files (there were afew). – terary Jan 19 '16 at 11:59
  • 2
    I have seen comments and the video on the thefuck link suggests that while the github command is thefuck, the actual command is fuck. Wether your is the same or not, that is more complicated. – Rui F Ribeiro Jan 19 '16 at 12:45
  • 1
    I am being dummy. I already understood what fuck is doing there. Described my theory, and added a very useful sysdig link and command. – Rui F Ribeiro Jan 19 '16 at 13:08
  • 1
    You're the best mane @Rui – terary Jan 19 '16 at 16:22
1

you could use htop to show its processes tree and system monitor to see what files are opened by the virus , links between different virus binaries and take a copy of everything so you can use Idapro, Cuckoo or Gdb to disassemble them

wireshark could help you see if it is like metasploit's meterpreter or just a bot

  • 2
    htop wont show you files, it will show processes. – Rui F Ribeiro Jan 19 '16 at 13:05
  • 2
    @RuiFRibeiro my mistake, i meant processes tree, you are right – user3566929 Jan 19 '16 at 13:20
0

Its a derivative of: DbSecuritySpt https://github.com/ValdikSS/billgates-botnet-tracker I happend to stumble across this as I was decommissioning the server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.