security breach

[mark edwards]

hello -

this morning i was alerted to a couple of rogue php scripts that mysteriously showed up in two places.

has anybody else seen a script called "n1.php" show up somewhere?

also, is there any source where i can "post" the script for further examination? i will see if ClamAV has something like that, but maybe i should post in other places as well.

i am tempted to create a temporary vps and try running the script & see what it does. i am too lazy to dissect the code.

EDIT:
i looked in all my logs for any reference to "n1.php" and blocked all those IP addresses. also removed n1.php of course.

 

[Quags]

Whats the sha256sum

You can check if we have seen it at http://sigs.interserver.net/info?ha...e62a061f53485990e70c6ef2c7b072362719981bc0611

where 019777156a8e8f72602e62a061f53485990e70c6ef2c7b072362719981bc0611 is the files sha256 sum

 

[mark edwards]

b67263f0664c3ed4ae1130c1211c14e0c3b0eabe94fb6a19263665820a1fece1

 

[Quags]

Have not seen this one, still have it?

 

[mark edwards]

its now in my /home/mark/ directory (n1.php.gz) and also attached (please first rename .zip to .gz)