The "Mayhem Shellshock" warning advisory released: http://blog.malwaremustdie.org/2014/10/ ... ayhem.html
Many details for detection and mitigation information, please read even once.
Pointers:
1. Grep your httpd access log to spot whether your systems are targeted or not, see the grep howto in the post.
2. They use different spider ELF module which aiming for the shellshock vulnerability
3. Perl installer is used after being downloaded in /tmp, and malware installer will be deleted afterward after dropped and executed, so.. system's process, socket network and memory detection is the only way to recognize the infection, as well to the dropped crypted file sytem (the .xxxx file).
4. The malware will run using the web server privilege, if you use web server under root please change it now.
5. The ip addresses listed in the report were extracted & compiled from many VPS services in many countries (JP, AU, NZ, MY, KR) and we confirmed that the attack was received in US, Spain too, assuming word-wide attack in progress, clean up listed ip address or block them will be good to reduce the risk of infection.
6. Please help to inform more attacker source ip addresses, as well as more samples. Your every help is counts to reduce the risk caused by this threat.
Rgds/MalwareMustDie
Many details for detection and mitigation information, please read even once.
Pointers:
1. Grep your httpd access log to spot whether your systems are targeted or not, see the grep howto in the post.
2. They use different spider ELF module which aiming for the shellshock vulnerability
3. Perl installer is used after being downloaded in /tmp, and malware installer will be deleted afterward after dropped and executed, so.. system's process, socket network and memory detection is the only way to recognize the infection, as well to the dropped crypted file sytem (the .xxxx file).
4. The malware will run using the web server privilege, if you use web server under root please change it now.
5. The ip addresses listed in the report were extracted & compiled from many VPS services in many countries (JP, AU, NZ, MY, KR) and we confirmed that the attack was received in US, Spain too, assuming word-wide attack in progress, clean up listed ip address or block them will be good to reduce the risk of infection.
6. Please help to inform more attacker source ip addresses, as well as more samples. Your every help is counts to reduce the risk caused by this threat.
Rgds/MalwareMustDie
