http://code.google.com/p/caffsec-malware-analysis/source/browse/trunk/ssyslog/ssyslog-strings.txt
A few interesting items jumped out at me.
First, here are a list of files which were associated with compiling .ssyslog:
util.h
udp_flood.h
syn_flood.h
ack_flood.h
dns_flood.h
update.h
getdns.h
connect.h
main.c
types.h
stddef.h
time.h
pthreadtypes.h
stdint.h
types.h
time.h
select.h
socket.h
sockaddr.h
in.h
stdio.h
libio.h
netdb.h
globel.h
ip.h
udp.h
tcp.h
config.h
ip.h
Second, I found this interesting tidbit:
GET / HTTP/1.1
User-Agent: huituzi-monitor
Accept: */*
host:
about.huituzi.net
I've never heard of huituzi-monitor. Anyone?
I also found that the performs some DNS checks using 8.8.8.8, which is Google's public DNS server. I assume this is for cross checking of external DNS references to internal ones?
Finally, the following IP addresses are present in .ssyslog, however, they aren't present in the decompiled version.
Their purpose is currently unknown. Based on the format, they are most likely subnet masks.
Do you recognize any of these? Preliminary searching shows all of these IP addresses blocks are registered to China.
112.100.0.0
219.147.219.0
219.147.237.0
222.170.67.0
218.7.250.0
218.7.7.0
218.7.80.0
218.8.128.0
221.210.153.0
221.210.200.0
221.211.8.0
60.11.111.0
60.11.141.0
60.11.254.0
60.15.127.0
60.219.1.0
61.180.140.0
61.180.230.0
202.118.166.0
202.118.176.0
202.118.192.0
202.118.223.0
202.118.224.0
219.149.194.0
202.98.0.0
221.9.167.0
61.138.129.0
61.138.186.0
111.116.64.0
202.198.16.0
202.198.8.0
59.72.128.0
219.148.204.0
219.149.6.0
202.96.64.0
202.96.69.0
60.19.18.0
125.222.200.0
202.118.1.0
202.118.40.0
202.118.48.0
202.118.66.0
202.118.81.0
219.217.80.0
222.26.127.0
219.141.148.0
219.141.157.0
220.181.125.0
220.181.19.0
220.181.61.0
202.106.0.0
202.106.195.0
202.106.196.0
61.135.178.0
61.135.23.0
202.112.112.0
202.112.128.0
202.112.14.0
202.112.176.0
202.112.20.0
202.112.209.0
202.120.224.0
202.204.112.0
202.204.160.0
202.204.48.0
202.204.60.0
202.204.65.0
202.205.0.0
202.205.208.0
202.205.80.0
202.207.240.0
202.4.130.0
210.31.32.0
210.35.128.0
210.42.159.0
210.44.112.0
210.47.244.0
211.64.144.0
211.66.88.0
211.68.71.0
211.81.20.0
219.243.239.0
219.150.59.0
202.99.69.0
202.99.96.0
202.113.112.0
202.113.128.0
202.113.15.0
202.113.168.0
202.113.32.0
202.113.48.0
202.113.64.0
202.113.80.0
202.113.96.0
211.68.208.0
211.68.224.0
59.67.148.0
219.148.19.0
222.222.202.0
222.222.222.0
121.17.127.0
121.28.7.0
202.99.171.0
218.11.142.0
218.12.131.0
218.12.199.0
221.194.33.0
221.194.57.0
60.10.134.0
60.2.145.0
60.6.40.0
60.8.44.0
202.206.100.0
202.206.144.0
202.206.160.0
202.206.192.0
202.206.223.0
202.206.48.0
202.206.80.0
219.146.2.0
123.129.192.0
218.58.118.0
222.132.102.0
60.215.138.0
202.116.0.0
202.194.116.0
202.194.133.0
202.194.145.0
202.194.15.0
202.194.40.0
202.194.48.0
211.87.176.0
219.218.18.0
219.149.135.0
121.30.5.0
124.163.5.0
124.164.7.0
124.165.6.0
124.166.7.0
124.167.4.0
202.97.131.0
202.99.216.0
60.220.6.0
60.221.4.0
60.222.1.0
60.223.7.0
202.117.0.0
219.244.0.0
117.34.127.0
125.76.192.0
218.30.19.0
61.134.1.0
123.139.188.0
123.139.211.0
221.11.64.0
221.11.89.0
202.117.128.0
202.117.64.0
202.117.96.0
202.200.112.0
202.200.144.0
202.200.32.0
202.200.48.0
202.200.80.0
202.201.252.0
210.27.80.0
218.195.208.0
218.195.24.0
218.195.56.0
219.247.255.0
222.24.94.0
222.25.77.0
59.76.48.0
222.74.1.0
222.74.126.0
110.6.180.0
116.113.84.0
202.207.0.0
202.207.16.0
210.31.176.0
124.224.20.0
221.199.1.0
221.199.14.0
202.201.152.0
61.178.0.0
61.178.2.0
221.7.34.0
202.201.0.0
202.201.18.0
202.201.32.0
202.201.48.0
202.201.64.0
202.201.80.0
202.201.89.0
210.26.0.0
210.26.16.0
202.100.128.0
202.100.138.0
221.207.58.0
61.128.114.0
221.7.1.0
202.201.160.0
202.98.224.0
202.98.239.0
221.13.65.0
210.41.4.0
125.70.254.0
182.151.191.0
218.6.200.0
220.167.29.0
124.161.97.0
221.10.25.0
60.255.80.0
202.115.112.0
202.115.128.0
202.115.144.0
202.115.160.0
202.115.192.0
202.115.32.0
202.115.64.0
202.115.80.0
202.202.145.0
202.202.192.0
202.202.208.0
202.202.96.0
211.83.241.0
222.176.21.0
222.180.120.0
61.128.128.0
61.128.130.0
61.128.192.0
221.5.203.0
221.7.92.0
202.202.0.0
202.202.32.0
202.103.44.0
221.232.247.0
59.175.246.0
58.19.121.0
58.19.122.0
202.114.0.0
202.114.112.0
202.114.200.0
202.114.255.0
202.114.32.0
202.114.64.0
202.114.79.0
202.114.88.0
202.114.96.0
202.197.159.0
211.67.48.0
211.84.160.0
211.84.208.0
218.196.240.0
218.197.80.0
222.85.85.0
222.88.49.0
222.88.88.0
202.102.224.0
202.102.227.0
61.163.252.0
125.219.48.0
202.196.0.0
202.196.192.0
202.196.208.0
202.196.32.0
202.196.64.0
202.196.80.0
202.196.96.0
202.197.208.0
210.43.128.0
210.43.144.0
210.43.24.0
211.67.128.0
211.67.191.0
218.198.48.0
218.198.80.0
222.21.112.0
59.69.128.0
202.102.192.0
202.102.199.0
202.102.214.0
61.132.161.0
211.162.0.0
58.242.16.0
58.242.160.0
58.242.176.0
58.242.193.0
58.242.2.0
58.242.48.0
202.38.64.0
210.45.128.0
210.45.144.0
210.45.16.0
210.45.240.0
210.45.92.0
221.228.255.0
222.92.170.0
61.147.37.0
61.155.104.0
122.192.80.0
221.6.151.0
221.6.176.0
221.6.231.0
221.6.246.0
221.6.4.0
221.6.96.0
58.240.56.0
58.240.57.0
58.241.208.0
202.119.112.0
202.119.168.0
202.119.200.0
202.119.208.0
202.119.24.0
202.119.32.0
202.119.64.0
202.119.80.0
202.195.112.0
202.195.160.0
202.195.176.0
210.28.39.0
210.28.80.0
210.29.152.0
210.29.64.0
211.65.116.0
211.65.64.0
116.228.111.0
116.236.159.0
180.168.255.0
202.96.209.0
112.64.143.0
112.65.184.0
58.247.118.0
202.120.127.0
202.120.143.0
202.120.144.0
202.120.181.0
202.120.2.0
202.120.80.0
202.121.138.0
202.121.48.0
210.35.68.0
115.236.4.0
125.112.124.0
125.123.0.0
202.101.172.0
202.101.173.0
202.96.113.0
218.75.3.0
220.187.246.0
60.191.249.0
61.130.219.0
61.153.177.0
61.153.198.0
61.153.81.0
61.153.83.0
61.174.95.0
61.175.111.0
123.157.135.0
123.157.240.0
124.160.12.0
221.12.100.0
221.12.49.0
221.12.65.0
221.12.85.0
210.32.0.0
210.33.24.0
222.246.129.0
59.51.78.0
61.187.72.0
58.20.125.0
58.20.126.0
202.197.240.0
202.197.64.0
210.43.192.0
210.43.47.0
202.101.224.0
202.101.226.0
61.131.253.0
118.212.168.0
222.204.2.0
218.85.152.0
218.85.157.0
58.22.100.0
58.22.101.0
58.23.0.0
58.23.9.0
210.34.0.0
210.34.128.0
210.34.32.0
210.34.48.0
219.229.132.0
202.98.192.0
202.98.198.0
202.98.199.0
221.13.28.0
221.13.30.0
210.40.0.0
210.40.128.0
210.40.144.0
210.40.64.0
222.172.200.0
222.221.0.0
221.3.136.0
202.203.128.0
202.203.160.0
202.203.208.0
202.203.230.0
210.40.176.0
119.145.45.0
202.96.136.0
61.140.11.0
120.80.10.0
120.80.11.0
120.80.193.0
120.80.201.0
120.80.237.0
120.80.8.0
120.80.9.0
210.21.114.0
210.21.2.0
210.22.3.0
220.249.251.0
221.4.147.0
221.4.158.0
221.4.224.0
221.5.1.0
58.251.56.0
58.251.57.0
202.116.128.0
202.116.160.0
202.116.192.0
202.116.32.0
202.192.88.0
202.38.193.0
218.192.12.0
218.192.144.0
218.192.240.0
219.223.222.0
219.223.252.0
219.223.254.0
222.17.127.0
222.200.128.0
222.200.129.0
180.137.252.0
222.217.39.0
121.31.60.0
221.7.138.0
221.7.247.0
210.36.158.0
210.36.16.0
202.100.192.0
202.100.199.0
221.11.156.0
210.37.79.0