-> ...he-he,they're running their server under windows:
Notice: Undefined variable: add_sub in C:\BigApache\Apache\htdocs\ddos\panel\online.php on line 36
Notice: Undefined index: a in C:\BigApache\Apache\htdocs\ddos\panel\index.php on line 133
And all of the installed apache modules listed in plain view also...
...quickly unpacked it and checked it in PEiD's disasm,
all done really quickly,didn't run it actually to see what files it creates,
or bothered checking in extensively under Olly or so...that's what I got/assume it's happening...
(original crap is written under Delphi):
it's listening all on interfaces (0.0.0.0) and also uses icmp.dll,I don't think it's for dosing though,
most probably for notifying the "mothership" in some irc channel or so...
Few strings to get the idea of what it does,quite self-explanatory...
it almost certainly copies itself to "Common files\System" dir along with a start.bat...
silently installs itself to registry in order to autostart/"survive" after reboots.
REGEDIT /S "
Program Files\Common Files\
The last link mentioned above,spawns a file with the string "0" in it...
I suppose it means no update available?
Couldn't find neither temp.exe or exe.exe host in the links above,
didn't wanted to run it directly to see if it is the same one that gets renamed,
or if they're downloaded from somewhere else...
played also with the names of the dirs in the address above without luck...
I also saw a bit of xoring going on though,so I thought,
taking under consideration that these executables aren't available in the links above,
maybe they're hosted somewhere else...
and what about about this update.php,it's nowhere to be found...
either is it for storing infected ip addresses data,
or more probably it redirects to the executables in question...
...So I fired up Google,and came up with this thread in Polish,
a few more info and a couple malware links listed there also...http://www.webhostingtalk.pl/index.php?showtopic=9542&pid=73313
And if you search for "TsunamiOverHost",
first link you'll land over is the...h4cky0u forum,lol...
P.S:...just remembered Anubis' service...http://analysis.seclab.tuwien.ac.at
It pretty much says the same,adding that "autostart.exe" mentioned above,
gets created under the usual "Startup" location of Windows...
Analysis though still doesn't mention anything about "temp.exe" and "exe.exe":
maybe it also searches for executables named as such,in order to delete them...