The remote host is reporting back to a control server associated with the IoT Reaper (aka "IoT Troop") botnet threat. A backdoor is likely present on the machine and may be used as part of a 'botnet', allowing attackers to perform distributed denial-of-service attack (DDoS attack), steal data, send spam, and allow attackers access to the device and its connection.

The remote host seems to be infected with Mirai malware. This host was observed fetching a malicious binary for the Mirai botnet. Mirai is a linux-based botnet that primarily targets online consumer devices such as remote cameras, home routers, and DVRs. Once a system is compromised, it will download additional tools to interact with the botnet and for persistence.

NNM detected suspicious activity that indicates a remote client interacting and issuing commands on the server via a remote web shell. Once uploaded, an attacker can use other techniques to escalate privileges and issue commands remotely. The remote commands issued have the same privilege and functionality available to the web server and may include the ability to add or delete files, run shell commands, and execute additional exploitation methods.

NNM Detected a suspicous PHP file using obfuscation.

The remote web server may contain a PHP script that acts as a backdoor and provides a convenient set of tools for attacking the affected host. At least one instance of 'c99shell' (or a derivative, such as c100 or Locus7Shell) is hosted on the remote web server.

The remote host seems to be infected with the Apache CDorked backdoor.  This backdoor allows a remote user to create a shell and/or pass the server commands via specially crafted HTTP requests.  In addition, the backdoor is used to further infect web clients by redirecting them to sites which infect the client with malware.

The remote host appears to be infected with the Pushdo botnet.

The remote host has been observed performing a DNS lookup to a domain associated with the Flame malware command and control servers.

The remote host appears to be infected with the Flame worm.  This worm uses a multitude of exploit modules to gather information and exploit local machines.

The remote host was observed performing DNS lookups to an IP address that is included in the DNSChanger rogue servers.  This indicates that the remote host is infected with DNSChanger. DNSChanger hijacks DNS settings on a system causing the host to query the DNSChanger rogue servers.  

The remote SMTP server has just been observed initiating an FTP outbound session and retrieving a file.  This may be an indicator that the system has been compromised and attackers are now retrieving files to the local server.

The remote machine is infected with the WinEggDrop virus/backdoor.

The remote proxy allows SMTP connections to be tunneled using the HTTP CONNECT method. If this an open proxy (ie, it is remotely accessible by those outside the corporate network), then this feature may be used to send SPAM mail.

When discovering a Windows command shell running as a service, it almost always indicates the system has been compromised.

The remote machine is infected with the RXBOT virus/backdoor.

The remote host seems to be running a trojan or 'backdoor' program - BACKDOOR subseven 22.  This is typically an indicator that the machine has been compromised and is now being remotely controlled.

The remote host seems to be running a trojan or 'backdoor' program - netbus.  This is typically an indicator that the machine has been compromised and is now being remotely controlled.

The remote host seems to be running a trojan or 'backdoor' program - Doly 2.0.  This is typically an indicator that the machine has been compromised and is now being remotely controlled

The remote host seems to be running a trojan or 'backdoor' program - QAZ Worm remote access.  This is typically an indicator that the machine has been compromised and is now being remotely controlled

The remote host seems to be running a trojan or 'backdoor' program - win-trin00.  This is typically an indicator that the machine has been compromised and is now being remotely controlled

The remote host seems to be running a trojan or 'backdoor' program - BACKDOOR Matrix 2.0 Client connect.  This is typically an indicator that the machine has been compromised and is now being remotely controlled

The remote host seems to be running a trojan or 'backdoor' program - GateCrasher.  This is typically an indicator that the machine has been compromised and is now being remotely controlled

The remote host seems to be running a trojan or 'backdoor' program - BACKDOOR SatansBackdoor.2.0.Beta.  This is typically an indicator that the machine has been compromised and is now being remotely controlled

The remote host seems to be running a trojan or 'backdoor' program -- BACKDOOR Infector.1.x.  This is typically an indicator that the machine has been compromised and is now being remotely controlled 

The remote host is a MetaSploit server and has just exploited a machine and is currently controlling it via the reverse HTTP meterpreter.  

The remote host has been compromised by a MetaSploit server.  The machine was just observed connecting to the server to register itself as a connection.  

The remote host has been compromised by a MetaSploit server. 

The remote web site seems to link to malicious javascript files hosted on a third party web site related to the LizaMoon Malware.  This typically means that the remote web site has been compromised, likely through SQL injection, and it may infect its visitors as well.

The remote SSL server is using a certificate which has been revoked.  The particular SSL certificate has a serial number of '\x00\xf5\xc8\x6a\xf3\x61\x62\xf1\x3a\x64\xf5\x4f\x6d\xc9\x58\x7c\x06' and an Issuer of USERTRUST.  

The remote SSL server is using a certificate which has been revoked. The particular SSL certificate has a serial number of '\x04\x7e\xcb\xe9\xfc\xa5\x5f\x7b\xd0\x9e\xae\x36\xe1\x0c\xae\x1e' and an Issuer of USERTRUST. 

The remote SSL server is using a certificate which has been revoked.  The particular SSL certificate has a serial number of '\xd7\x55\x8f\xda\xf5\xf1\x10\x5b\xb2\x13\x28\x2b\x70\x77\x29\xa3' and an Issuer of USERTRUST.  

The remote SSL server is using a certificate which has been revoked.  The particular SSL certificate has a serial number of '\xe9\x02\x8b\x95\x78\xe4\x15\xdc\x1a\x71\x0a\x2b\x88\x15\x44\x47' and an Issuer of USERTRUST.  

The remote SSL server is using a certificate which has been revoked.  The particular SSL certificate has a serial number of '\xb0\xb7\x13\x3e\xd0\x96\xf9\xb5\x6f\xae\x91\xc8\x74\xbd\x3a\xc0' and an Issuer of USERTRUST.  

The remote SSL server is using a certificate which has been revoked.  The particular SSL certificate has a serial number of '\x72\x03\x21\x05\xc5\x0c\x08\x57\x3d\x8e\xa5\x30\x4e\xfe\xe8\xb0' and an Issuer of USERTRUST.  

The remote SSL server is using a certificate which has been revoked.  The particular SSL certificate has a serial number of '\xd8\xf3\x5f\x4e\xb7\x87\x2b\x2d\xab\x06\x92\xe3\x15\x38\x2f\xb0' and an Issuer of USERTRUST.  

The remote SSL server is using a certificate which has been revoked.  The particular SSL certificate has a serial number of '\x92\x39\xd5\x34\x8f\x40\xd1\x69\x5a\x74\x54\x70\xe1\xf2\x3f\x43' and an Issuer of USERTRUST.  

The remote host is running the Stuxnet trojan.  This was determined based on the RPC UUID.  Stuxnet is a Trojan which uses multiple vulnerabilities to infect and spread to nearby hosts.  Ultimately, the Trojan attempts to gain access to a SCADA network. 

The remote host is passing RPC traffic which is requesting an RPC UUID which is synonymous with the Stuxnet trojan.  This may indicate that either the host is infected with Stuxnet or the host is scanning for Stuxnet-infected machines.  

This client connected to a server and downloaded an executable in the Portable Executable (PE) format. This format includes Windows executables with the '.exe' and '.dll' extensions. This may be evidence of some malware which are known to propagate in this manner.

This service appears to send a Microsoft Windows executable when a connection to it is established.  This may be evidence of some malware which are known to propagate in this manner.  There is not a file name associated with this executable.  That is, the client created a TCP/IP connection to the host, at which time the host sent an executable back to the client.  The NNM has determined that this is an Microsoft executable based upon the format of the binary.

A host is making HTTP requests that are formatted as a Warbot command would be.  This is indicitive of an infection by the Warbot trojan.  The Warbot trojan allows for arbitrary code to be executed on the system, as well as enables it to be used in various DDoS attacks. 

Activity generated by the Storm/Pecoan.AG worm have been detected by NNM.  This activity indicates that the host in question is currently communicating with a Storm Command and Control server, and is likely participating in spamming activities. 

Arugizer backdoor activity has been detected. This indicates that a successful reply to a YES command sent to the Arugizer backdoor has been seen, which is a clear sign that the backdoor is installed and responding to commands.

The remote host seems to be infected by the Conficker worm. This worm has several capabilities that allow an attacker to execute arbitrary code on the remote operating system.  The remote host might also be attempting to propagate the worm to third-party hosts. 

The remote service supports the DNS-to-TCP protocol.  This protocol hides network traffic protocols by embedding the traffic within seemingly innocuous DNS queries.  This service can be used to bypass firewalls or proxies by obfuscating the true protocol within the DNS protocol. 

ID	Name	Severity
700194	IoT Reaper Backdoor Detection	critical
9750	Mirai Botnet - Binary Fetch Detection	high
9489	ASP Web Shell Detection (China Chopper)	high
9488	JSP Web Shell Detection (China Chopper)	high
9487	PHP Web Shell Detection (China Chopper)	high
6926	PHP Code Obfuscation	info
6925	PHP c99shell Backdoor Script Detection	high
6800	Apache CDorked backdoor detection	critical
6579	Pushdo Botnet Detection	critical
7058	DNS Client Flame Infection	high
6492	Flame Worm Detection	critical
7055	DNSChanger Detection	high
6246	FTP Client Initiated from an SMTP Server	high
6232	Trojan/Backdoor Detection - WinEggDrop Infected Host Detection	critical
6231	SMTP Proxy Traffic Detected	medium
6230	Windows Command Shell as Service	high
6229	Trojan/Backdoor Detection - Windows Command Shell as Service	high
6228	Trojan/Backdoor Detection - RXBOT / RBOT Vulnerability Scan	critical
6227	Trojan/Backdoor Detection - RXBOT / RBOT Exploit Report	critical
6226	Trojan/Backdoor Detection - Subseven	critical
6225	Trojan/Backdoor Detection - netbus	critical
6224	Trojan/Backdoor Detection - Doly 2.0	critical
6223	Trojan/Backdoor Detection - QAZ Worm	critical
6222	Trojan/Backdoor Detection - win-trin00	critical
6221	Trojan/Backdoor Detection - BACKDOOR Matrix 2.0 Client	critical
6220	Trojan/Backdoor Detection - GateCrasher	critical
6219	Trojan/Backdoor Detection - BACKDOOR SatansBackdoor.2.0.Beta	critical
6218	Trojan/Backdoor Detection - BACKDOOR Infector.1.x	critical
5976	MetaSploit Server Detection	high
5975	MetaSploit Exploited Machine Detection	high
5974	MetaSploit Exploited Machine Detection	high
5880	LizaMoon Malware Detection	critical
5841	SSL Revoked Certificate Detection	critical
5840	SSL Revoked Certificate Detection	critical
5839	SSL Revoked Certificate Detection	critical
5838	SSL Revoked Certificate Detection	critical
5837	SSL Revoked Certificate Detection	critical
5836	SSL Revoked Certificate Detection	critical
5835	SSL Revoked Certificate Detection	critical
5834	SSL Revoked Certificate Detection	critical
5738	Stuxnet Infected Host Detection	critical
5721	Stuxnet Traffic Detection	info
5706	Microsoft Portable Executable (PE) in Transit Detection (Client)	critical
5701	Microsoft Executable in Transit Detection	critical
5549	Trojan/Backdoor - Warbot Detection	critical
5526	Trojan/Backdoor - Storm/Pecoan.AG Worm Detection	critical
5357	Trojan/Backdoor - Arugizer Detection	high
4978	Trojan/Backdoor Detection - Conficker Detection	critical
4977	Trojan/Backdoor Detection - Conficker Detection	critical
4657	Dns2TCP Service Detection	info

Detections

Analytics

Backdoors Family for Nessus Network Monitor

critical

high

high

high

high

info

high

critical

critical

high

critical

high

high

critical

medium

high

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

high

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

info

critical

critical

critical

critical

high

critical

critical

info