[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: a compromised machine



On Tue, Jul 26, 2005 at 10:02:52PM +0200, Nejc Novak wrote:
> Can you get any information out of this cron file? I tried creating the 
> same exec that this file creats, but obiously i was doing sth wrong :)

The crontab writes out a binary file and executes it.  I straced the
binary on a virtual machine with no network.

It's attempting to connect to two different hosts:

210.169.91.66:5454
216.254.95.2:53



-Ed

Attachment: signature.asc
Description: Digital signature


Reply to: