Tag Info

New answers tagged

-2

The shellcode's encoding is basic hex referencing. The ELF is likely related to the Ramnit botnet.


2

I think you're the proud owner of a "libworker.so" backdoor! Malware Must Die has a good analysis of it, read that before running it yourself. The Malware Must Die author isn't a native english speaker, but does disclose a ton of detail. Malware Must Die has the PHP "dropper" code getting downloaded via a copy of "Web Shell by oRb", so you're going to need ...


0

Have you looked in /var/spool/cron and /etc/crontab or any other CRON subdirectory inside of /var or /etc? Perhaps you could see any cron jobs scheduled here. If you've already determined the ELF file was part of the infection, to answer the last part of your question, I would only run it in a sandboxed environment if you want to get a true view of what it ...



Top 50 recent answers are included