What's the meaning of this binary sequence arriving at my http server?

Asked Feb 21 '20 at 20:31

Active Feb 21 '20 at 20:31

Viewed 1,337 times

I'm running a http server written in Rebol and sometimes I see that the server is woken by data like this arriving at port 80

0300002F2AE00000000000436F6F6B69653A206D737473686173683D41646D696E697374720D0A0100080003000000

In the logs I see that over two days I've seen this happen three times. Is this some type of attack?

The server is a F1 micro instance running on Google's compute cloud.

asked Feb 21 '20 at 20:31

Graham Chiu

2

Most of the packet is ASCII: `Cookie: mstshash=Administr`. It is just some RDP worm. – Piotr P. Karwasz Feb 21 '20 at 23:40
@PiotrP.Karwasz Thanks. can you add that as an answer? – Graham Chiu Feb 22 '20 at 18:54
It's more of a hint, rather than an answer. Someone can certainly tell you what kind of virus/worm is it. – Piotr P. Karwasz Feb 22 '20 at 20:09
https://isc.sans.edu/forums/diary/Random+Port+Scan+for+Open+RDP+Backdoor/24422/ discusses this as well – Graham Chiu Feb 23 '20 at 23:28

0 Answers0