EvoMalware, shell script to detect infected websites.
Go to file
Benoît S. dd880d78b7 Add rules to the whitelist 2018-11-08 10:17:56 +01:00
Makefile Added suspect files. 2015-01-22 17:38:03 +01:00
README.md Update README 2018-11-02 10:31:41 +01:00
evomalware.filenames Added a SPAM mailer. 2015-08-17 11:22:11 +02:00
evomalware.filenames.md5 Added a SPAM mailer. 2015-08-17 11:22:11 +02:00
evomalware.patterns Added patterns 2018-10-30 17:33:58 +01:00
evomalware.patterns.md5 Added patterns 2018-10-30 17:33:58 +01:00
evomalware.sh Adding support for .js files 2018-10-19 15:05:53 +02:00
evomalware.suspect Added suspect files. 2015-01-22 17:38:03 +01:00
evomalware.suspect.md5 Added suspect files. 2015-01-22 17:38:03 +01:00
evomalware.whitelist Add rules to the whitelist 2018-11-08 10:17:56 +01:00
evomalware.whitelist.md5 Add rules to the whitelist 2018-11-08 10:17:56 +01:00

README.md

Description

EvoMalware is a BASH script which permits to identify files (PHP/JS only ATM) infected by malwares/virus/backdoor.
The main goal is to be used in a cron job to generate reports, but it can be used in "one shot" mode.

The script uses 3 flat text files as databases:

  • evomalware.filenames, known filenames.
  • evomalware.patterns, known patterns.
  • evomalware.whitelist, files to ignore.

There is also an "aggressive" mode which permits to find suspect files using evomalware.suspect DB.
At each run, the script downloads the last databases.

Configuration/Tuning

TODO

Upstream

Upstream is at https://gitea.evolix.org/evolix/evomalware
GitHub is a mirror.

Interesting others projects