evolix
/
evomalware
16
1
Fork 0
Code Issues 10 Pull Requests 0 Releases 0 Wiki Activity
EvoMalware, shell script to detect infected websites.
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
58 Commits
1 Branch
102 KiB
 
 
Tree: 25c3aafba0
Branches Tags
${ item.name }
Create branch ${ searchTerm }
from '25c3aafba0'
${ noResults }
 ZIP  TAR.GZ
Benoît S. 25c3aafba0 Adding support for .js files 2 years ago
Makefile Added suspect files. 6 years ago
README.md Fixed typographical error, changed aggresive to aggressive in README. 5 years ago
evomalware.filenames Added a SPAM mailer. 5 years ago
evomalware.filenames.md5 Added a SPAM mailer. 5 years ago
evomalware.patterns New pattern 2 years ago
evomalware.patterns.md5 New pattern 2 years ago
evomalware.sh Adding support for .js files 2 years ago
evomalware.suspect Added suspect files. 6 years ago
evomalware.suspect.md5 Added suspect files. 6 years ago
evomalware.whitelist Update whitelist 3 years ago
evomalware.whitelist.md5 Update whitelist 3 years ago

README.md

Description

EvoMalware is a BASH script which permits to identify files (PHP only ATM) infected by malwares/virus/backdoor.
The main goal is to be used in a cron job to generate reports, but it can be used in "one shot" mode.

The script uses 3 flat text files as databases:

  • evomalware.filenames, known filenames.
  • evomalware.patterns, known patterns.
  • evomalware.whitelist, files to ignore.

There is also an "aggressive" mode which permits to find suspect files using evomalware.suspect DB.
At each run, the script downloads the last databases.

Configuration/Tuning

TODO

Upstream

Upstream is at https://forge.evolix.org/projects/evomalware
GitHub is a mirror.

Interesting others projects