Top

Tag Archives | signatures

Pure-FTPd with ClamAV at Directadmin Custombuild

This tutorial we integrate ClamAV into Pure-FTPd for virus scanning in Directadmin server with Custombuild. Whenever a file gets uploaded through Pure-FTPd, ClamAV will check the file and delete it if it is malware. Installing Pure-FTPd & ClamAV First we need change custom build options.conf setting Check options.conf #ClamAV-related Settings clamav=yes pureftpd_uploadscan=yes Building software Building […]

Continue Reading

WordPress Hidden Include

Today we found undetected malware, which keep it hidden and try loading again if it deleted. We generated Signatures to Detect these hidden includes: /index.php: {HEX}Malware.Expert.wordpress.hidden.include.0.UNOFFICIAL FOUND /wp-load.php: {HEX}Malware.Expert.wordpress.hidden.include.1.UNOFFICIAL FOUND /wp-includes/template.php: {HEX}Malware.Expert.malware.url.7od.info.0.UNOFFICIAL FOUND /wp-includes/Requests/IPconfig.ini: {HEX}Malware.Expert.generic.malware.39.UNOFFICIAL FOUND /wp-includes/js/utilities.js: {HEX}Malware.Expert.generic.malware.39.UNOFFICIAL FOUND WordPress index.php wp-load.php End of file: template.php IPconfig.ini Remove file utilities.js Remove file Final Words Use […]

Continue Reading

Cryptonight

This again new malware which we call cryptonight, what we haven’t seen before. It’s downloads executable Linux program and hides that http daemon in background, which is difficult find process list at first glance. Manual remove process You can search if there running process httpd, which start cryptonight parameter: ps aux | grep cryptonight Then […]

Continue Reading

Phoenix WebShell

New web shell (PHOENIX SHELL), what we have not seen this this before. This is typical webshell, except there are a lot of extra features: Upload Command Execute Mass Deface cPanel crack CGI Telnet WordPress auto Deface Fake root Etc … In the action Final words Use Malware Expert – Signatures detect this Web shell […]

Continue Reading

Proc.php trying injecting header.php files

When this malware successful uploaded customer website and access it GET request, it’s trying search backward files and folder, searching header.php files. indexEditor When all folders and files searched and header.php files founded, it tries the patch malicious code to header.php file. Malicious code In begin this malware have CODE which added wanted file’s: Final […]

Continue Reading

Google site verification – cookie based file upload

Today we found new malware that our signatures not before detected. First look it just like Google site verification code HTML file witch have also meta tags. Also added Robots to prevent index this file google. If someone tries to access this file from the browser, it just looks normal verification code and view source […]

Continue Reading

WordPress hidden cookie (wp_cookie)

We found very old and hidden WordPress cookie, which named wp_cookie. This allows an attacker to run anything on the compromised user website with user permissions. wp_cookie This is a very clever attack method that allows arbitrary commands to run on a server with ignoring any server security software, just like normal PHP code. Also, […]

Continue Reading

CowoKerensTeam File Manager

The malware is a PHP File Manager – a script, which when installed on a compromised system, presents a sophisticated administration platform allowing the attacker to browse the filesystem of the compromised server, upload, create, edit, download or delete files. CowoKerensTeam File Manager Today we found new PHP webshell, what we have not seen before […]

Continue Reading

WordPress backdoor cache.php

Today we found cache.php malware, which uses server old backdoor to get more malware to the server. The server is compromised before and it uses hidden file Silence is golden – Malware to POST Payload more data to the server. POST Payload – cache.php If we look better POST Payload, which trying upload cache.php, execute […]

Continue Reading

Sanesecurity start distribute Malware.Expert malware signatures

Today we are very happy new distribution channel. Sanesecurity started sharing our Malware signatures via their distribution channels worldwide to new servers. Sanesecurity signatures Sanesecurity produces add-ons signatures to help improve the ClamAV detection rate on Zero-Day malware and even on Zero-Hour malware. Also add-on signatures provide enhanced email security against the following email types: […]

Continue Reading