1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
|
Rule:
--
Sid:
3012
--
Summary:
This event is generated when an attacker attempts to remotely upload and
execute a file with the RUX the Tick trojan.
--
Impact:
If successful, the attacker would gain unauthorized access to an
affected system, enabling him to upload and execute file on the machine.
The attacker can use this function to upload additional backdoors to the
victim's sytem and execute them.
--
Detailed Information:
When executed, RUX the Tick opens up its assigned port (default is
22222) for communication with the attacker. RUX the Tick has three
functions: Get Windows Directory, Get System Directory, and Upload And
Execute File.
Get Windows Directory and Get System Directory are used for
reconnaissance. Upload And Execute File is mainly used to upload and run
other backdoors onto the victim's computer.
--
Affected Systems:
Windows 95/98/ME/NT/2000
--
Attack Scenarios:
The victim must first install the server. Be wary of suspicious files
because they often can be backdoors in disguise. Once the victim
mistakenly installs the server program, the attacker usually will employ
an IP scanner program to find the IP addresses of victims that have
installed the program. Then the attacker enters the IP address, port
number (which is assigned to the server program by the attacker:
default is 22222), and presses the connect button and he has access to
the computer.
--
Ease of Attack:
Simple.
--
False Positives:
None known
--
False Negatives:
None known
--
Corrective Action:
Using Windows Task Manager, kill these processes: ruxserver.exe and server.exe
Use Windows Explorer to find ruxserver.exe and delete the file.
This program may hide itself in the process list and can use different
names and can exist in many locations on an infected machine.
Keep anti-virus programs updated with the latest definitions.
--
Contributors:
Sourcefire Research Team
Ricky Macatee <rmacatee@sourcefire.com>
--
Additional References:
PestPatrol:
http://www.pestpatrol.com/PestInfo/R/RUX.ASP
--
|
