Analysis of files in hax-small.tgz


A few observations on the similarities and differences between files in hax.tgz and hax-small.tgz.
  1. Most of the files in hax-small.tgz is identical to those found in hax.tgz except the following: create, hax, mailme, pa, and salut.
  2. create and mailme are also found in hax.tgz, but the content are different.
  3. hax, pa, and salut not found in hax.tgz. On the other hand, setup and the tools/psybnc are found in hax.tgz, but not hax-small.tgz.

create
Performs similar function as counterpart in hax.tgz. The only difference is that instead of trying to cp nscd and the various ssh configuration/key files, this script perform a mv operation.

mailme
Performs similar function as counter part in bigwar.tgz , except for additional echoing of informational strings in Romanian.

hax
File type Shell script
Analysis
 Performs similar function as hax/setup script, but this script is in Romanian, rather than English. In addition, it performs the following additional tasks:
  1. downloads wget-1_5_3-1_i386.rpm from ftp.intraware.com and installed it
  2. downloads pico from asmo.net26.pl
  3. mv salut and pa into /usr/bin
  4. removes trace of rootkit, i.e remove hax.tgz and the hax directory

pa
File type Shell script
Analysis
 No useful work done by this script

salut
File type Shell script
Analysis
 Unsets various shell variables. These variables include
HISTSAVE
HISTFILE
HISTLOG
LOG
LOGSAVE
SCREEN
SSHACCESS