Information about the Beastkit Rootkit

This rootkit was found on a RedHat 7.2 System in 01/2002. The rootkit setup
script includes the line "#Beastkit 7.0 - X-Org edition". Due to this fact,
we call it as "Beastkit 7.0".

For more info, look at this analyse (author unknown):
http://www.ossec.net/rootkits/studies/beastkit.txt

Files to search:

• usr/local/bin/bin
• usr/man/.man10
• usr/sbin/arobia
• usr/lib/elm/arobia
• usr/local/bin/.../bktd

Openned ports used by beastkit:

• 56493

*All files with an "*" need to be search in all system
**If you have any more information, send to: mail1, or to mail2.




$RootCheck: beastkit.php ,v 1.0 2003/10/17, Daniel B. Cid$