According to Dr.web there is a new linux malware called Linux.BackDoor.FakeFile.1
, it can speared throught .pdf
, gedit
, open-office files .. , it can execute a multiples malicious functions using the user's right ( it doesn't require root privilege ) :
It then searches for a hidden file, whose name matches the file name of the Trojan, and replaces the executable file with it. For instance, if an ELF file of Linux.BackDoor.FakeFile.1 is named AnyName.pdf, the Trojan will search for a hidden file under the name .AnyName.pdf and then replace the original file with it by using the command
mv
.
Because the malware is recently (added on 2016-10-14) added to Dr.Web virus database, is that possible to verify linux systems by detecting and removing the backdoor through the command line ?