General
-
Target
6f06db46cdfd664265e6534fdcd04ac172c8080762ade1cf34d86539ec1bda3d
-
Size
270KB
-
MD5
512b6c8f2a713b987bcbe345eb0b2434
-
SHA1
184b51fb45669a8f158682472acb249743d199d0
-
SHA256
6f06db46cdfd664265e6534fdcd04ac172c8080762ade1cf34d86539ec1bda3d
-
SHA512
c7b53fc471689b6255a2a58b6c23b4b984367722c29e83aa58dd204fa5a2514b6fdf9106e57bbe4528860ac2d591bd93a83046677f0d92bb8a7792e9e823f3fc
-
SSDEEP
3072:IwJ+GhUhvOIHMRG362aLEMRBZuJ5cyn88/QmAgolU787JRzjKEtaWRGtnj8uqVid:IwJ+G8F0Ee0J5Hd/QmSGuJsEowUnCid
Score
N/A
Malware Config
Signatures
Files
-
6f06db46cdfd664265e6534fdcd04ac172c8080762ade1cf34d86539ec1bda3d
-
COPYING
-
CREDITS
-
FDL.txt
-
GPL.txt
-
Makefile
-
README
-
README-src
-
README-xml
-
TODO
-
configure.pl
-
etc/Disasm.pm
-
etc/Entity.pm
-
etc/GetElfBase.pm
-
etc/Makefile/infection
-
etc/Makefile/scanner
-
etc/Makefile/scanner_driver
-
etc/Makefile/scanner_mkinfect
-
etc/Makefile/test-infection
-
etc/Misc.pm
-
etc/PackageTool.pm
-
etc/Section.pm
-
etc/SectionSet.pm
-
etc/Segment.pm
-
etc/SegmentSet.pm
-
etc/SystemName.pm
-
etc/WhichHash.pm
-
etc/aspell
-
etc/calc.pl
-
etc/check_link
-
etc/check_yref
-
etc/dict.txt
-
etc/fileref.pl
-
etc/ftp.dat
-
etc/http.dat
-
etc/ldp-html-common.xsl
-
etc/ldp-html.xsl
-
etc/ldp.dsl
-
etc/mkdir.sh
-
etc/mkdisasm.sh
-
etc/mkdist.sh
-
etc/mkhtml.sh
-
etc/mkyref.pl
-
etc/patch_dsl.pl
-
etc/pkg_man.pm
-
etc/pkg_ver.pm
-
etc/rmdir
-
etc/tar-exclude
-
etc/titles.sh
-
etc/titles.xslt
-
etc/ulink.pl
-
etc/wget.sh
-
etc/yref-intro.xslt
-
etc/yref-platform.xslt
-
etc/yref.sh
-
intro/additional.cs.xml
-
intro/author.xml
-
intro/dual.use.technology.xml
-
intro/example.asm.txt
-
intro/global.xml
-
intro/intro.xml
-
intro/main.xml
-
intro/mirrors.xml
-
intro/one.step.closer.xml
-
intro/platforms.xml
-
intro/revision.history.xml
-
intro/rst.xml
-
intro/scanners.xml
-
intro/scratch.xml
-
intro/segment.padding.xml
-
intro/yref.xml
-
intro/yref/GDB.to.the.rescue.xml
-
intro/yref/a.section.called.text.xml
-
intro/yref/additional.cs.xml
-
intro/yref/devil.in.disguise.xml
-
intro/yref/doing.it.in.c.xml
-
intro/yref/e_entry.xml
-
intro/yref/entry.point.xml
-
intro/yref/finding.executables.xml
-
intro/yref/food.for.segment.padding.xml
-
intro/yref/infection.1.xml
-
intro/yref/language.of.evil.xml
-
intro/yref/objdump.d.xml
-
intro/yref/off.we.go.xml
-
intro/yref/offset.of.e_entry.xml
-
intro/yref/packages.xml
-
intro/yref/scanners.xml
-
intro/yref/sections.xml
-
intro/yref/segment.padding.xml
-
intro/yref/segments.xml
-
intro/yref/self.modifying.code.xml
-
intro/yref/variables.prefixed.with.tevwh.xml
-
intro/yref/verifying.installed.packages.xml
-
platform/additional.cs.xml
-
platform/additional.cs/default.xml
-
platform/additional.cs/find.ok/SunOS.xml
-
platform/additional.cs/note/hexdump.xml
-
platform/additional.cs/note/readelf.xml
-
platform/additional.cs/note/xxd.xml
-
platform/additional.cs/readelf.xml
-
platform/doing.it.in.c.xml
-
platform/entry.point.xml
-
platform/language.of.evil.xml
-
platform/language.of.evil/default.xml
-
platform/language.of.evil/hand.crafted/i386-Linux.xml
-
platform/language.of.evil/infection/i386.xml
-
platform/language.of.evil/infection/sparc.xml
-
platform/language.of.evil/ndisasm.xml
-
platform/magic.of.elf.xml
-
platform/magic.of.elf/hexdump.xml
-
platform/magic.of.elf/other.magic/Linux.xml
-
platform/magic.of.elf/other.magic/default.xml
-
platform/magic.of.elf/xxd.xml
-
platform/magic.revealed.xml
-
platform/magic.revealed/ndisasm.xml
-
platform/magic.revealed/syscall/asm/i386-Linux.xml
-
platform/magic.revealed/syscall/asm/sparc-Linux.xml
-
platform/magic.revealed/syscall/asm/sparc-SunOS.xml
-
platform/magic.revealed/syscall/man/FreeBSD.xml
-
platform/magic.revealed/syscall/man/Linux.xml
-
platform/magic.revealed/syscall/man/SunOS.xml
-
platform/magic.revealed/syscall/platform/sparc.xml
-
platform/main.xml
-
platform/packages.xml
-
platform/packages/distid.xml
-
platform/packages/finding.owner/FreeBSD.xml
-
platform/packages/finding.owner/SunOS.xml
-
platform/packages/finding.owner/deb.xml
-
platform/packages/finding.owner/rpm.xml
-
platform/packages/finding.owner/slackware.xml
-
platform/packages/isainfo.xml
-
platform/packages/isalist.xml
-
platform/packages/nopkg/deb.xml
-
platform/packages/nopkg/deb/usr_bin_perl.xml
-
platform/packages/nopkg/slackware.xml
-
platform/packages/nopkg/slackware/nopkg_bin_bash.xml
-
platform/packages/os/code/default.xml
-
platform/packages/os/code/sparc-sunos5.9.xml
-
platform/packages/os/uname/FreeBSD.xml
-
platform/packages/os/uname/Linux.xml
-
platform/packages/os/uname/SunOS.xml
-
platform/packages/os/vendor/default.xml
-
platform/packages/verify/FreeBSD.xml
-
platform/packages/verify/SunOS.xml
-
platform/packages/verify/deb.xml
-
platform/packages/verify/rpm.xml
-
platform/packages/verify/slackware.xml
-
platform/scanners.xml
-
platform/sections.xml
-
platform/sections/elfdump.xml
-
platform/sections/readelf.xml
-
platform/sections/sh/default.xml
-
platform/sections/sh/readelf.xml
-
platform/segment.padding.xml
-
platform/segment.padding/default.xml
-
platform/segment.padding/readelf.xml
-
platform/segments.xml
-
platform/segments/elfdump.xml
-
platform/segments/readelf.xml
-
platform/segments/sh/default.xml
-
platform/segments/sh/readelf.xml
-
platform/stub.revisited.xml
-
platform/suspicious.code.xml
-
platform/yref.xml
-
platform/yref/additional.cs.xml
-
platform/yref/cc.sh.xml
-
platform/yref/dressing.up.binary.code.xml
-
platform/yref/e_entry.xml
-
platform/yref/executable.and.linkable.format.xml
-
platform/yref/finding.executables.xml
-
platform/yref/food.for.segment.padding.xml
-
platform/yref/gdb.format.pl.xml
-
platform/yref/get.seg.xml
-
platform/yref/ids.xml
-
platform/yref/objdump.format.pl.xml
-
platform/yref/offset.of.e_entry.xml
-
platform/yref/one.step.closer.xml
-
platform/yref/scan.entry.point.xml
-
platform/yref/scan.filesize.xml
-
platform/yref/scan.note.xml
-
platform/yref/scan.segments.xml
-
platform/yref/scanners.xml
-
platform/yref/segment.padding.xml
-
platform/yref/self.modifying.code.xml
-
platform/yref/target.copy.and.infect.1.xml
-
platform/yref/target.copy.and.infect.2.xml
-
platform/yref/target.write.infection.1.xml
-
src/additional_cs/additional_cs.c
-
src/additional_cs/copy_and_infect.inc
-
src/additional_cs/new_entry_addr.inc
-
src/additional_cs/note/hexdump.sh
-
src/additional_cs/note/objdump-name.sh
-
src/additional_cs/note/objdump.sh
-
src/additional_cs/note/od.sh
-
src/additional_cs/note/offset.sh
-
src/additional_cs/note/readelf-name.sh
-
src/additional_cs/note/readelf.sh
-
src/additional_cs/note/xxd.sh
-
src/additional_cs/objdump.sh
-
src/additional_cs/patch_phdr.inc
-
src/additional_cs/patch_shdr.inc
-
src/additional_cs/readelf.sh
-
src/additional_cs/scan_segment.sh
-
src/doing_it_in_c/addr.c
-
src/doing_it_in_c/body.inc
-
src/doing_it_in_c/do_syscall.inc
-
src/doing_it_in_c/doing_it_in_c.c
-
src/doing_it_in_c/get_relocate_ofs.inc
-
src/doing_it_in_c/intel.sh
-
src/doing_it_in_c/write_infection.inc
-
src/entry_point/__libc_start_main
-
src/entry_point/att.sh
-
src/entry_point/entry_point.sh
-
src/entry_point/gdb/FreeBSD.sh
-
src/entry_point/gdb/Linux.sh
-
src/entry_point/gdb/SunOS.sh
-
src/entry_point/gdb_core.sh
-
src/entry_point/get_libc_start_main.sh
-
src/entry_point/intel.sh
-
src/entry_point/ldd.sh
-
src/entry_point/nm.sh
-
src/evil_magic/alpha_FreeBSD_att.S
-
src/evil_magic/alpha_Linux_att.S
-
src/evil_magic/att.sh
-
src/evil_magic/cc.sh
-
src/evil_magic/e_entry.c
-
src/evil_magic/e_entry.sh
-
src/evil_magic/first_gdb_func.sed
-
src/evil_magic/func/alpha_FreeBSD_att.S
-
src/evil_magic/func/alpha_Linux_att.S
-
src/evil_magic/func/i386_FreeBSD_att.S
-
src/evil_magic/func/i386_Linux_intel.S
-
src/evil_magic/func/sparc_Linux_att.S
-
src/evil_magic/func/sparc_SunOS_att.S
-
src/evil_magic/gdb_nm.sh
-
src/evil_magic/gdb_write.sh
-
src/evil_magic/i386_FreeBSD_att.S
-
src/evil_magic/i386_Linux_att.S
-
src/evil_magic/i386_Linux_intel.S
-
src/evil_magic/intel.sh
-
src/evil_magic/ndisasm.sh
-
src/evil_magic/nm.sh
-
src/evil_magic/objdump.sh
-
src/evil_magic/od.sh
-
src/evil_magic/ofs_entry.c
-
src/evil_magic/self_modify.c
-
src/evil_magic/sparc_Linux_att.S
-
src/evil_magic/sparc_SunOS_att.S
-
src/evil_magic/static_write.sh
-
src/format.hex
-
src/magic_elf/addr_of_main.c
-
src/magic_elf/cc.sh
-
src/magic_elf/cc_static.sh
-
src/magic_elf/gdb.sh
-
src/magic_elf/gdb_core.sh
-
src/magic_elf/gdb_format.pl
-
src/magic_elf/hexdump.sh
-
src/magic_elf/magic_elf.c
-
src/magic_elf/ndisasm.sh
-
src/magic_elf/objdump.sh
-
src/magic_elf/objdump_format.pl
-
src/magic_elf/od/FreeBSD.sh
-
src/magic_elf/od/Linux.sh
-
src/magic_elf/od/SunOS.sh
-
src/magic_elf/other_exe.sh
-
src/magic_elf/other_mem.sh
-
src/magic_elf/other_perl.pl
-
src/magic_elf/strings.sh
-
src/magic_elf/xxd.sh
-
src/one_step_closer/action.inc
-
src/one_step_closer/att.sh
-
src/one_step_closer/cc.sh
-
src/one_step_closer/check.h
-
src/one_step_closer/close.inc
-
src/one_step_closer/e1/patch_entry_addr.inc
-
src/one_step_closer/e2/patch_entry_addr.inc
-
src/one_step_closer/e3/patch_entry_addr.inc
-
src/one_step_closer/gcc-filter.pl
-
src/one_step_closer/get_entry_code.inc
-
src/one_step_closer/get_seg.inc
-
src/one_step_closer/i1/alpha_FreeBSD_att.S
-
src/one_step_closer/i1/alpha_Linux_att.S
-
src/one_step_closer/i1/i386_FreeBSD_att.S
-
src/one_step_closer/i1/i386_Linux_intel.S
-
src/one_step_closer/i1/sparc_Linux_att.S
-
src/one_step_closer/i1/sparc_SunOS_att.S
-
src/one_step_closer/i2/i386_Linux_intel.S
-
src/one_step_closer/i3/i386_Linux_intel.S
-
src/one_step_closer/i4/i386_Linux_intel.S
-
src/one_step_closer/infect.sh
-
src/one_step_closer/intel.sh
-
src/one_step_closer/is_elf.inc
-
src/one_step_closer/main.inc
-
src/one_step_closer/mktest.sh
-
src/one_step_closer/open_dst.inc
-
src/one_step_closer/open_src.inc
-
src/one_step_closer/prefix.inc
-
src/one_step_closer/print_errno.inc
-
src/one_step_closer/print_summary.inc
-
src/one_step_closer/suffix.inc
-
src/one_step_closer/target.h
-
src/one_step_closer/test-postfix.sh
-
src/one_step_closer/test-prefix.sh
-
src/one_step_closer/trace_infector.h
-
src/one_step_closer/trace_scanner.h
-
src/one_step_closer/write_infection.inc
-
src/packages/FreeBSD/du.sh
-
src/packages/FreeBSD/file_list.sh
-
src/packages/FreeBSD/simple.sh
-
src/packages/FreeBSD/verify.sh
-
src/packages/SunOS/du.sh
-
src/packages/SunOS/isainfo.sh
-
src/packages/SunOS/isalist.sh
-
src/packages/SunOS/simple.sh
-
src/packages/SunOS/verify-all.sh
-
src/packages/SunOS/verify.sh
-
src/packages/SunOS/version.sh
-
src/packages/deb/du.sh
-
src/packages/deb/hard.sh
-
src/packages/deb/perl.sh
-
src/packages/deb/simple.sh
-
src/packages/deb/status.sh
-
src/packages/deb/verify.sh
-
src/packages/distid.sh
-
src/packages/man-all/FreeBSD.sh
-
src/packages/man-all/Linux.sh
-
src/packages/man-all/SunOS.sh
-
src/packages/man-section/FreeBSD.sh
-
src/packages/man-section/Linux.sh
-
src/packages/man-section/SunOS.sh
-
src/packages/rpm/custom.sh
-
src/packages/rpm/du.sh
-
src/packages/rpm/simple.sh
-
src/packages/rpm/verify-all.sh
-
src/packages/rpm/verify.sh
-
src/packages/slackware/bash.sh
-
src/packages/slackware/du.sh
-
src/packages/slackware/simple.sh
-
src/packages/uname.sh
-
src/platform/disasm.pl
-
src/rst/01.inc
-
src/rst/02.inc
-
src/scanner/additional_cs/action.inc
-
src/scanner/additional_cs/additional_cs.c
-
src/scanner/additional_cs/print_summary.inc
-
src/scanner/available.sh
-
src/scanner/entry_point/objdump.pl
-
src/scanner/filesize/action.inc
-
src/scanner/filesize/filesize_scanner.c
-
src/scanner/filesize/print_summary.inc
-
src/scanner/filetype.sh
-
src/scanner/find-exec.sh
-
src/scanner/find-ok.sh
-
src/scanner/find-shell.lst
-
src/scanner/find-shell.sh
-
src/scanner/mkinfect.lst
-
src/scanner/mkinfect.pl
-
src/scanner/mktest.sh
-
src/scanner/objdump.sh
-
src/scanner/plain.sh
-
src/scanner/segment_padding/action.inc
-
src/scanner/segment_padding/cc.sh
-
src/scanner/segment_padding/print_summary.inc
-
src/scanner/segment_padding/segment_padding.c
-
src/sections/elfdump.sh
-
src/sections/objdump.sh
-
src/sections/readelf.sh
-
src/sections/sh/objdump.sh
-
src/sections/sh/readelf.sh
-
src/segment_padding/copy_and_infect.inc
-
src/segment_padding/new_entry_addr.inc
-
src/segment_padding/objdump.sh
-
src/segment_padding/patch_phdr.inc
-
src/segment_padding/patch_shdr.inc
-
src/segment_padding/readelf.sh
-
src/segment_padding/scan_segment.sh
-
src/segment_padding/segment_padding.c
-
src/segment_padding/sysconf.c
-
src/segments/elfdump.sh
-
src/segments/objdump.sh
-
src/segments/readelf.sh
-
src/segments/sh/objdump.sh
-
src/segments/sh/readelf.sh
-
src/stub_revisited/__libc_start_main
-
src/stub_revisited/get_libc_start_main.sh
-
src/stub_revisited/intel.sh
-
src/stub_revisited/intel_ret.sh
-
src/stub_revisited/stack.sh
-
src/suspicious_code/dumpsection.pl
-
src/suspicious_code/intel.sh