Skip to main content
[nepenthes] New malware coming in

I just wondering why my ClamAV did not detect the fetched malware as "malware", instead just OK. But then since nepenthes already classified it as "suspicious binary".. and why would a binary being sent to my honeypot anyway?

I also create a cron job to ensure that ClamAV updates its definition, sixth times per day.

This is the first time I was being alerted by the malware submission after I enabled the submit_norman.so line.

my very own 1st automated malware submission

The other links was being redirected to joebox.. it just shows this stuffs along with the zip file contains reports of the analyzed malware:

The attached zip document contains all kind of behaviour information which Joebox has detected.
Please note that Joebox currently only analyse file system, registry system and process system behaviour.
Analysis information about network, services and thread activities will be added in the next months.
The analysis machine which executes your submitted binaries has no access to the internet.
An all time available internet connection is a too high risk either to be detected (via dns) or to be controlled by malware (we use real machines for analysis) which bypasses our used disk protection tools.

Best regards

Joe Security


Hehe.. nice ;) .. you know that, this submission alert was received after the power trip/network problem here was resolved. It means, I should get this alert earlier..

It seems that this network segment contains a lot of "harta karun" or "hidden treasure" which unexplored.... looking at this ClamAV scan, 3 binaries yet to be defined..

root@nuvox:/var/lib/nepenthes/binaries# clamscan *
0c6734accaf1d500a388f690a1ef3a76: OK
381dd5ff2ef3993bd92923626ee7948a: OK
3d39a29913a2fe54009d491b89b01ab4: W32.Virut.ca FOUND
8e072862754ef6e80831d2fd50376b43: Trojan.DsBot-15 FOUND
ba106399aad8b515319f52fac4794a73: OK
c2f699282a7a16ecf554cfbaa2724204: W32.Virut.ci FOUND

----------- SCAN SUMMARY -----------
Known viruses: 309947
Engine version: 0.92.1
Scanned directories: 0
Scanned files: 6
Infected files: 3
Data scanned: 0.25 MB
Time: 12.340 sec (0 m 12 s)


Comments

Popular posts from this blog

Panduan Bas Ekspres Kuala Lumpur (TBS) - Skudai

Nota ringkas untuk saya. Bas dari KL (Terminal Bas Bersepadu Selatan, TBS) ke Johor Bahru (Larkin Terminal) secara umum bermula 8 pagi hingga ke pukul 12 malam. Ada banyak syarikat yang ke sana jadi boleh dikatakan tiket boleh dibeli secara on-spot tanpa belian awal.
Harga tiket adalah sekitar RM31-32 bergantung kepada syarikat. Sesetengah syarikat mengenakan caj tambahan 10 sen untuk insurans. 
TBS boleh dihubungkan dengan stesen Komuter, ERL, dan LRT. LRT akan tamat perkhidmatan pada pukul 1130 malam jadi rancang perjalanan supaya tak perlu ambil perkhidmatan teksi yang cekik darah.. contohnya dari TBS ke Taman Cempaka Ampang kalau naik LRT hanya RM1.60, naik "Teksi Bajet" (bajet la sangat) adalah RM33 
Bas dari KL-JB turun di Larkin. Sekiranya belajar/ada urusan di UTM Skudai, beritahu pemandu bas untuk turun di Taman Sri Putri/Sri Putri. Kemudian boleh ambil teksi di seberang jalan (naik jejantas), untuk ambil teksi sapu atau teksi berdaftar. Jangkaan harga teksi adalah…

Cara Renew Passport Pembantu Rumah di Kedutaan Indonesia 2015

Tulisan ni sah sehingga 17 Febuari 2015 semalam.


Ceritanya aku bermula dari seminggu sebelum 17 Feb 2015 tu lagi.. passport bibik aku expired pada Oktober 2015, jadi cadang nak buat sementara aku tengah cuti belajar ni.. ingat settle sehari macam ditulis pada kebanyakan blog, tapi disebabkan kedutaan NKRI ni tengah berubah kepada sistem biometrik (dia ambil cap 10 jari, semua tangan kanan dan kiri!).. Ginilah ceritanya:


Minggu satu
Hari Selasa : Datang pukul 7. Pukul 9 bukak gate. Pengawal kata.. nombor ambik Isnin atau Khamis sahaja

Hari Khamis: Datang pukul 7 pagi. Pukul 9 pagi bukak gate.. dalam pukul 10 pagi dapat nombor..
serah 3 borang kontrak dan dokumen
datang esok untuk buat passport

Hari Jumaat: Datang pukul 9 PAGI.. sebab nombor dah ada.. pukul 1230tghari staf embassy kata "DATANG BALIK LEPAS JUMAAT". so balik rumah solat jumaat.. pukul 3ptg datang balik. ambik gambar PUKUL LAPAN MALAM HAHAHAHA
Datang lagi ye.. Hari Selasa depan.. PUKUL DUA PETANG


Minggu dua
Hari Selasa: D…