Hutizu Under the Hood

Been looking at the STRINGS result of .ssyslog... Which is now detected by a small number of AV vendors as "Hutizu"

http://code.google.com/p/caffsec-malware-analysis/source/browse/trunk/ssyslog/ssyslog-strings.txt

A few interesting items jumped out at me.




First, here are a list of files which were associated with compiling .ssyslog:

util.h
udp_flood.h
syn_flood.h
ack_flood.h
dns_flood.h
update.h
getdns.h
connect.h
main.c
types.h
stddef.h
time.h
pthreadtypes.h
stdint.h
types.h
time.h
select.h
socket.h
sockaddr.h
in.h
stdio.h
libio.h
netdb.h
globel.h
ip.h
udp.h
tcp.h
config.h
ip.h

Second, I found this interesting tidbit:

GET / HTTP/1.1
User-Agent: huituzi-monitor
Accept: */*
host: 
about.huituzi.net

I've never heard of huituzi-monitor.  Anyone?


I also found that the performs some DNS checks using 8.8.8.8, which is Google's public DNS server.  I assume this is for cross checking of external DNS references to internal ones?


Finally, the following IP addresses are present in .ssyslog, however, they aren't present in the decompiled version.

Their purpose is currently unknown.  Based on the format, they are most likely subnet masks.

Do you recognize any of these? Preliminary searching shows all of these IP addresses blocks are registered to China.

112.100.0.0
219.147.219.0
219.147.237.0
222.170.67.0
218.7.250.0
218.7.7.0
218.7.80.0
218.8.128.0
221.210.153.0
221.210.200.0
221.211.8.0
60.11.111.0
60.11.141.0
60.11.254.0
60.15.127.0
60.219.1.0
61.180.140.0
61.180.230.0
202.118.166.0
202.118.176.0
202.118.192.0
202.118.223.0
202.118.224.0
219.149.194.0
202.98.0.0
221.9.167.0
61.138.129.0
61.138.186.0
111.116.64.0
202.198.16.0
202.198.8.0
59.72.128.0
219.148.204.0
219.149.6.0
202.96.64.0
202.96.69.0
60.19.18.0
125.222.200.0
202.118.1.0
202.118.40.0
202.118.48.0
202.118.66.0
202.118.81.0
219.217.80.0
222.26.127.0
219.141.148.0
219.141.157.0
220.181.125.0
220.181.19.0
220.181.61.0
202.106.0.0
202.106.195.0
202.106.196.0
61.135.178.0
61.135.23.0
202.112.112.0
202.112.128.0
202.112.14.0
202.112.176.0
202.112.20.0
202.112.209.0
202.120.224.0
202.204.112.0
202.204.160.0
202.204.48.0
202.204.60.0
202.204.65.0
202.205.0.0
202.205.208.0
202.205.80.0
202.207.240.0
202.4.130.0
210.31.32.0
210.35.128.0
210.42.159.0
210.44.112.0
210.47.244.0
211.64.144.0
211.66.88.0
211.68.71.0
211.81.20.0
219.243.239.0
219.150.59.0
202.99.69.0
202.99.96.0
202.113.112.0
202.113.128.0
202.113.15.0
202.113.168.0
202.113.32.0
202.113.48.0
202.113.64.0
202.113.80.0
202.113.96.0
211.68.208.0
211.68.224.0
59.67.148.0
219.148.19.0
222.222.202.0
222.222.222.0
121.17.127.0
121.28.7.0
202.99.171.0
218.11.142.0
218.12.131.0
218.12.199.0
221.194.33.0
221.194.57.0
60.10.134.0
60.2.145.0
60.6.40.0
60.8.44.0
202.206.100.0
202.206.144.0
202.206.160.0
202.206.192.0
202.206.223.0
202.206.48.0
202.206.80.0
219.146.2.0
123.129.192.0
218.58.118.0
222.132.102.0
60.215.138.0
202.116.0.0
202.194.116.0
202.194.133.0
202.194.145.0
202.194.15.0
202.194.40.0
202.194.48.0
211.87.176.0
219.218.18.0
219.149.135.0
121.30.5.0
124.163.5.0
124.164.7.0
124.165.6.0
124.166.7.0
124.167.4.0
202.97.131.0
202.99.216.0
60.220.6.0
60.221.4.0
60.222.1.0
60.223.7.0
202.117.0.0
219.244.0.0
117.34.127.0
125.76.192.0
218.30.19.0
61.134.1.0
123.139.188.0
123.139.211.0
221.11.64.0
221.11.89.0
202.117.128.0
202.117.64.0
202.117.96.0
202.200.112.0
202.200.144.0
202.200.32.0
202.200.48.0
202.200.80.0
202.201.252.0
210.27.80.0
218.195.208.0
218.195.24.0
218.195.56.0
219.247.255.0
222.24.94.0
222.25.77.0
59.76.48.0
222.74.1.0
222.74.126.0
110.6.180.0
116.113.84.0
202.207.0.0
202.207.16.0
210.31.176.0
124.224.20.0
221.199.1.0
221.199.14.0
202.201.152.0
61.178.0.0
61.178.2.0
221.7.34.0
202.201.0.0
202.201.18.0
202.201.32.0
202.201.48.0
202.201.64.0
202.201.80.0
202.201.89.0
210.26.0.0
210.26.16.0
202.100.128.0
202.100.138.0
221.207.58.0
61.128.114.0
221.7.1.0
202.201.160.0
202.98.224.0
202.98.239.0
221.13.65.0
210.41.4.0
125.70.254.0
182.151.191.0
218.6.200.0
220.167.29.0
124.161.97.0
221.10.25.0
60.255.80.0
202.115.112.0
202.115.128.0
202.115.144.0
202.115.160.0
202.115.192.0
202.115.32.0
202.115.64.0
202.115.80.0
202.202.145.0
202.202.192.0
202.202.208.0
202.202.96.0
211.83.241.0
222.176.21.0
222.180.120.0
61.128.128.0
61.128.130.0
61.128.192.0
221.5.203.0
221.7.92.0
202.202.0.0
202.202.32.0
202.103.44.0
221.232.247.0
59.175.246.0
58.19.121.0
58.19.122.0
202.114.0.0
202.114.112.0
202.114.200.0
202.114.255.0
202.114.32.0
202.114.64.0
202.114.79.0
202.114.88.0
202.114.96.0
202.197.159.0
211.67.48.0
211.84.160.0
211.84.208.0
218.196.240.0
218.197.80.0
222.85.85.0
222.88.49.0
222.88.88.0
202.102.224.0
202.102.227.0
61.163.252.0
125.219.48.0
202.196.0.0
202.196.192.0
202.196.208.0
202.196.32.0
202.196.64.0
202.196.80.0
202.196.96.0
202.197.208.0
210.43.128.0
210.43.144.0
210.43.24.0
211.67.128.0
211.67.191.0
218.198.48.0
218.198.80.0
222.21.112.0
59.69.128.0
202.102.192.0
202.102.199.0
202.102.214.0
61.132.161.0
211.162.0.0
58.242.16.0
58.242.160.0
58.242.176.0
58.242.193.0
58.242.2.0
58.242.48.0
202.38.64.0
210.45.128.0
210.45.144.0
210.45.16.0
210.45.240.0
210.45.92.0
221.228.255.0
222.92.170.0
61.147.37.0
61.155.104.0
122.192.80.0
221.6.151.0
221.6.176.0
221.6.231.0
221.6.246.0
221.6.4.0
221.6.96.0
58.240.56.0
58.240.57.0
58.241.208.0
202.119.112.0
202.119.168.0
202.119.200.0
202.119.208.0
202.119.24.0
202.119.32.0
202.119.64.0
202.119.80.0
202.195.112.0
202.195.160.0
202.195.176.0
210.28.39.0
210.28.80.0
210.29.152.0
210.29.64.0
211.65.116.0
211.65.64.0
116.228.111.0
116.236.159.0
180.168.255.0
202.96.209.0
112.64.143.0
112.65.184.0
58.247.118.0
202.120.127.0
202.120.143.0
202.120.144.0
202.120.181.0
202.120.2.0
202.120.80.0
202.121.138.0
202.121.48.0
210.35.68.0
115.236.4.0
125.112.124.0
125.123.0.0
202.101.172.0
202.101.173.0
202.96.113.0
218.75.3.0
220.187.246.0
60.191.249.0
61.130.219.0
61.153.177.0
61.153.198.0
61.153.81.0
61.153.83.0
61.174.95.0
61.175.111.0
123.157.135.0
123.157.240.0
124.160.12.0
221.12.100.0
221.12.49.0
221.12.65.0
221.12.85.0
210.32.0.0
210.33.24.0
222.246.129.0
59.51.78.0
61.187.72.0
58.20.125.0
58.20.126.0
202.197.240.0
202.197.64.0
210.43.192.0
210.43.47.0
202.101.224.0
202.101.226.0
61.131.253.0
118.212.168.0
222.204.2.0
218.85.152.0
218.85.157.0
58.22.100.0
58.22.101.0
58.23.0.0
58.23.9.0
210.34.0.0
210.34.128.0
210.34.32.0
210.34.48.0
219.229.132.0
202.98.192.0
202.98.198.0
202.98.199.0
221.13.28.0
221.13.30.0
210.40.0.0
210.40.128.0
210.40.144.0
210.40.64.0
222.172.200.0
222.221.0.0
221.3.136.0
202.203.128.0
202.203.160.0
202.203.208.0
202.203.230.0
210.40.176.0
119.145.45.0
202.96.136.0
61.140.11.0
120.80.10.0
120.80.11.0
120.80.193.0
120.80.201.0
120.80.237.0
120.80.8.0
120.80.9.0
210.21.114.0
210.21.2.0
210.22.3.0
220.249.251.0
221.4.147.0
221.4.158.0
221.4.224.0
221.5.1.0
58.251.56.0
58.251.57.0
202.116.128.0
202.116.160.0
202.116.192.0
202.116.32.0
202.192.88.0
202.38.193.0
218.192.12.0
218.192.144.0
218.192.240.0
219.223.222.0
219.223.252.0
219.223.254.0
222.17.127.0
222.200.128.0
222.200.129.0
180.137.252.0
222.217.39.0
121.31.60.0
221.7.138.0
221.7.247.0
210.36.158.0
210.36.16.0
202.100.192.0
202.100.199.0
221.11.156.0
210.37.79.0