1

After executing sudo maldet -a /

LMD provides the following report:

HOST:      foo.bar.baz
SCAN ID:   210117-2223.1145531
STARTED:   Jan 17 2021 22:23:26 +0000
COMPLETED: Jan 18 2021 22:01:12 +0000
ELAPSED:   85066s [find: 42s]

PATH:          /
TOTAL FILES:   579780
TOTAL HITS:    2
TOTAL CLEANED: 0

WARNING: Automatic quarantine is currently disabled, detected threats are still accessible to users!
To enable, set quarantine_hits=1 and/or to quarantine hits from this scan run:
/usr/local/sbin/maldet -q 210117-2223.1145531

FILE HIT LIST:
{HEX}php.cmdshell.antichat.201 : /home/foo/maldetect-1.6.4/files/sigs/rfxn.yara
{HEX}php.gzbase64.inject.452 : /home/foo/maldetect-1.6.4/files/clean/gzbase64.inject.unclassed
===============================================
Linux Malware Detect v1.6.4 < proj@rfxn.com >

I struggle to interpret the results of the two hits. Is it in the home directory and what does HEX mean?

1 Answer 1

0

To quote the README from maldetect:

Let us assume for a moment we have malware that we want to clean and it trips with the signature "{HEX}php.cmdshell.r57.89". The actual signature string in this is "php.cmdshell.r57", the "{HEX}" just defines the format and ".89" is the variant number.

"format" in this will be either MD5 or HEX, the two types of maldetect signature. Quoting again, "The signatures that LMD uses are MD5 file hashes and HEX pattern matches..."

The two files that had 'hits' were both part of the maldetect distribution that foo unpacked under their home directory:

/home/foo/maldetect-1.6.4/files/sigs/rfxn.yara is a Yara signature file. It must contain a string that matches malicious software, but which also matches the tests that maldetect runs. It is not actually malicious.

/home/foo/maldetect-1.6.4/files/clean/gzbase64.inject.unclassed is a cleaner file, which contains malicious strings to be matched and erased from infected files. Again, it contains a string which matches a test that maldetect runs, but it isn't actually malicious.

The moral of this story is: don't scan the scanner directory. Here's someone else with the same problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.