http://code.google.com/p/caffsec-malware-analysis/source/browse/trunk/ssyslog/ssyslog-strings.txt
A few interesting items jumped out at me.
First, here are a list of files which were associated with compiling .ssyslog:
util.h udp_flood.h syn_flood.h ack_flood.h dns_flood.h update.h getdns.h connect.h main.c types.h stddef.h time.h pthreadtypes.h stdint.h types.h time.h select.h socket.h sockaddr.h in.h stdio.h libio.h netdb.h globel.h ip.h udp.h tcp.h config.h ip.h
Second, I found this interesting tidbit:
GET / HTTP/1.1 User-Agent: huituzi-monitor Accept: */* host: about.huituzi.net
I've never heard of huituzi-monitor. Anyone?
I also found that the performs some DNS checks using 8.8.8.8, which is Google's public DNS server. I assume this is for cross checking of external DNS references to internal ones?
Finally, the following IP addresses are present in .ssyslog, however, they aren't present in the decompiled version.
Their purpose is currently unknown. Based on the format, they are most likely subnet masks.
Do you recognize any of these? Preliminary searching shows all of these IP addresses blocks are registered to China.
112.100.0.0 219.147.219.0 219.147.237.0 222.170.67.0 218.7.250.0 218.7.7.0 218.7.80.0 218.8.128.0 221.210.153.0 221.210.200.0 221.211.8.0 60.11.111.0 60.11.141.0 60.11.254.0 60.15.127.0 60.219.1.0 61.180.140.0 61.180.230.0 202.118.166.0 202.118.176.0 202.118.192.0 202.118.223.0 202.118.224.0 219.149.194.0 202.98.0.0 221.9.167.0 61.138.129.0 61.138.186.0 111.116.64.0 202.198.16.0 202.198.8.0 59.72.128.0 219.148.204.0 219.149.6.0 202.96.64.0 202.96.69.0 60.19.18.0 125.222.200.0 202.118.1.0 202.118.40.0 202.118.48.0 202.118.66.0 202.118.81.0 219.217.80.0 222.26.127.0 219.141.148.0 219.141.157.0 220.181.125.0 220.181.19.0 220.181.61.0 202.106.0.0 202.106.195.0 202.106.196.0 61.135.178.0 61.135.23.0 202.112.112.0 202.112.128.0 202.112.14.0 202.112.176.0 202.112.20.0 202.112.209.0 202.120.224.0 202.204.112.0 202.204.160.0 202.204.48.0 202.204.60.0 202.204.65.0 202.205.0.0 202.205.208.0 202.205.80.0 202.207.240.0 202.4.130.0 210.31.32.0 210.35.128.0 210.42.159.0 210.44.112.0 210.47.244.0 211.64.144.0 211.66.88.0 211.68.71.0 211.81.20.0 219.243.239.0 219.150.59.0 202.99.69.0 202.99.96.0 202.113.112.0 202.113.128.0 202.113.15.0 202.113.168.0 202.113.32.0 202.113.48.0 202.113.64.0 202.113.80.0 202.113.96.0 211.68.208.0 211.68.224.0 59.67.148.0 219.148.19.0 222.222.202.0 222.222.222.0 121.17.127.0 121.28.7.0 202.99.171.0 218.11.142.0 218.12.131.0 218.12.199.0 221.194.33.0 221.194.57.0 60.10.134.0 60.2.145.0 60.6.40.0 60.8.44.0 202.206.100.0 202.206.144.0 202.206.160.0 202.206.192.0 202.206.223.0 202.206.48.0 202.206.80.0 219.146.2.0 123.129.192.0 218.58.118.0 222.132.102.0 60.215.138.0 202.116.0.0 202.194.116.0 202.194.133.0 202.194.145.0 202.194.15.0 202.194.40.0 202.194.48.0 211.87.176.0 219.218.18.0 219.149.135.0 121.30.5.0 124.163.5.0 124.164.7.0 124.165.6.0 124.166.7.0 124.167.4.0 202.97.131.0 202.99.216.0 60.220.6.0 60.221.4.0 60.222.1.0 60.223.7.0 202.117.0.0 219.244.0.0 117.34.127.0 125.76.192.0 218.30.19.0 61.134.1.0 123.139.188.0 123.139.211.0 221.11.64.0 221.11.89.0 202.117.128.0 202.117.64.0 202.117.96.0 202.200.112.0 202.200.144.0 202.200.32.0 202.200.48.0 202.200.80.0 202.201.252.0 210.27.80.0 218.195.208.0 218.195.24.0 218.195.56.0 219.247.255.0 222.24.94.0 222.25.77.0 59.76.48.0 222.74.1.0 222.74.126.0 110.6.180.0 116.113.84.0 202.207.0.0 202.207.16.0 210.31.176.0 124.224.20.0 221.199.1.0 221.199.14.0 202.201.152.0 61.178.0.0 61.178.2.0 221.7.34.0 202.201.0.0 202.201.18.0 202.201.32.0 202.201.48.0 202.201.64.0 202.201.80.0 202.201.89.0 210.26.0.0 210.26.16.0 202.100.128.0 202.100.138.0 221.207.58.0 61.128.114.0 221.7.1.0 202.201.160.0 202.98.224.0 202.98.239.0 221.13.65.0 210.41.4.0 125.70.254.0 182.151.191.0 218.6.200.0 220.167.29.0 124.161.97.0 221.10.25.0 60.255.80.0 202.115.112.0 202.115.128.0 202.115.144.0 202.115.160.0 202.115.192.0 202.115.32.0 202.115.64.0 202.115.80.0 202.202.145.0 202.202.192.0 202.202.208.0 202.202.96.0 211.83.241.0 222.176.21.0 222.180.120.0 61.128.128.0 61.128.130.0 61.128.192.0 221.5.203.0 221.7.92.0 202.202.0.0 202.202.32.0 202.103.44.0 221.232.247.0 59.175.246.0 58.19.121.0 58.19.122.0 202.114.0.0 202.114.112.0 202.114.200.0 202.114.255.0 202.114.32.0 202.114.64.0 202.114.79.0 202.114.88.0 202.114.96.0 202.197.159.0 211.67.48.0 211.84.160.0 211.84.208.0 218.196.240.0 218.197.80.0 222.85.85.0 222.88.49.0 222.88.88.0 202.102.224.0 202.102.227.0 61.163.252.0 125.219.48.0 202.196.0.0 202.196.192.0 202.196.208.0 202.196.32.0 202.196.64.0 202.196.80.0 202.196.96.0 202.197.208.0 210.43.128.0 210.43.144.0 210.43.24.0 211.67.128.0 211.67.191.0 218.198.48.0 218.198.80.0 222.21.112.0 59.69.128.0 202.102.192.0 202.102.199.0 202.102.214.0 61.132.161.0 211.162.0.0 58.242.16.0 58.242.160.0 58.242.176.0 58.242.193.0 58.242.2.0 58.242.48.0 202.38.64.0 210.45.128.0 210.45.144.0 210.45.16.0 210.45.240.0 210.45.92.0 221.228.255.0 222.92.170.0 61.147.37.0 61.155.104.0 122.192.80.0 221.6.151.0 221.6.176.0 221.6.231.0 221.6.246.0 221.6.4.0 221.6.96.0 58.240.56.0 58.240.57.0 58.241.208.0 202.119.112.0 202.119.168.0 202.119.200.0 202.119.208.0 202.119.24.0 202.119.32.0 202.119.64.0 202.119.80.0 202.195.112.0 202.195.160.0 202.195.176.0 210.28.39.0 210.28.80.0 210.29.152.0 210.29.64.0 211.65.116.0 211.65.64.0 116.228.111.0 116.236.159.0 180.168.255.0 202.96.209.0 112.64.143.0 112.65.184.0 58.247.118.0 202.120.127.0 202.120.143.0 202.120.144.0 202.120.181.0 202.120.2.0 202.120.80.0 202.121.138.0 202.121.48.0 210.35.68.0 115.236.4.0 125.112.124.0 125.123.0.0 202.101.172.0 202.101.173.0 202.96.113.0 218.75.3.0 220.187.246.0 60.191.249.0 61.130.219.0 61.153.177.0 61.153.198.0 61.153.81.0 61.153.83.0 61.174.95.0 61.175.111.0 123.157.135.0 123.157.240.0 124.160.12.0 221.12.100.0 221.12.49.0 221.12.65.0 221.12.85.0 210.32.0.0 210.33.24.0 222.246.129.0 59.51.78.0 61.187.72.0 58.20.125.0 58.20.126.0 202.197.240.0 202.197.64.0 210.43.192.0 210.43.47.0 202.101.224.0 202.101.226.0 61.131.253.0 118.212.168.0 222.204.2.0 218.85.152.0 218.85.157.0 58.22.100.0 58.22.101.0 58.23.0.0 58.23.9.0 210.34.0.0 210.34.128.0 210.34.32.0 210.34.48.0 219.229.132.0 202.98.192.0 202.98.198.0 202.98.199.0 221.13.28.0 221.13.30.0 210.40.0.0 210.40.128.0 210.40.144.0 210.40.64.0 222.172.200.0 222.221.0.0 221.3.136.0 202.203.128.0 202.203.160.0 202.203.208.0 202.203.230.0 210.40.176.0 119.145.45.0 202.96.136.0 61.140.11.0 120.80.10.0 120.80.11.0 120.80.193.0 120.80.201.0 120.80.237.0 120.80.8.0 120.80.9.0 210.21.114.0 210.21.2.0 210.22.3.0 220.249.251.0 221.4.147.0 221.4.158.0 221.4.224.0 221.5.1.0 58.251.56.0 58.251.57.0 202.116.128.0 202.116.160.0 202.116.192.0 202.116.32.0 202.192.88.0 202.38.193.0 218.192.12.0 218.192.144.0 218.192.240.0 219.223.222.0 219.223.252.0 219.223.254.0 222.17.127.0 222.200.128.0 222.200.129.0 180.137.252.0 222.217.39.0 121.31.60.0 221.7.138.0 221.7.247.0 210.36.158.0 210.36.16.0 202.100.192.0 202.100.199.0 221.11.156.0 210.37.79.0
No comments:
Post a Comment