Mac和linux下的病毒样本

luxiao200888

RT

感谢小夏...嘿嘿

悠柚

Starting the file scan:

Begin scan in 'D:\TDDownload\Mac OS_Sample 701'
D:\TDDownload\Mac OS_Sample 701\42\bin\ls
    [DETECTION] Contains recognition pattern of the LINUX/Piltot.A.1 Linux virus
D:\TDDownload\Mac OS_Sample 701\42\bin\ps
    [DETECTION] Contains HEUR/ELF.Malformed suspicious code
D:\TDDownload\Mac OS_Sample 701\adhoca\bin\virus
    [DETECTION] Contains recognition pattern of the LINUX/Ranfyg.A.2 Linux virus
D:\TDDownload\Mac OS_Sample 701\oxymoron\Menuet.Oxymoron
    [DETECTION] Contains recognition pattern of the MenuetOS.Oxymoron virus
D:\TDDownload\Mac OS_Sample 701\oxymoron\Menuet.Oxymoron.txt
    [DETECTION] Contains recognition pattern of the HTML/Silly.Gen HTML script virus
D:\TDDownload\Mac OS_Sample 701\tristesse\code.asm
    [DETECTION] Contains recognition pattern of the HTML/Silly.Gen HTML script virus
D:\TDDownload\Mac OS_Sample 701\tristesse\tristesse
    [DETECTION] Contains recognition pattern of the MenuetOS.Tristess virus
红伞是有Mac和Linux的病毒定义

悠柚

D:\TDDownload\Mac OS_Sample 701\oxymoron\Menuet.Oxymoron        Virus.Menuet.Xymo.a        病毒        还未处理
D:\TDDownload\Mac OS_Sample 701\tristesse\tristesse        Virus.Menuet.Tristesse.a        病毒        还未处理
费尔支持Mac Linux不太好

悠柚

D:\TDDownload\Mac OS_Sample 701\42\bin\ls         已检测: Linux.Piltot!IK
D:\TDDownload\Mac OS_Sample 701\42\bin\ps         已检测: Virus.Linux.Piltot!IK
D:\TDDownload\Mac OS_Sample 701\adhoca\bin\virus         已检测: Linux.Ranfyg!IK
D:\TDDownload\Mac OS_Sample 701\oxymoron\Menuet.Oxymoron         已检测: Virus.Menuet.Xymo.a!IK
D:\TDDownload\Mac OS_Sample 701\tristesse\tristesse         已检测: Virus.Menuet!IK
ik还行

悠柚

Sophos 1个
难道他没有？

taiyangshenqi

在苹果和linux下能运行吗？  

luxiao200888

当然

luxiao200888

avira  的这个启发HEUR/ELF.Malformed

jimmyleo

    Log is generated by AjLL.

< avast! >
    4096.asm --- Found Nothing
    balrog.asm --- Found Nothing
    Changelog --- Found Nothing
    debug.c --- Found Nothing
    layer1.c --- Found Nothing
    layer2.c --- Found Nothing
    Makefile --- Found Nothing
    README --- Found Nothing
    set_mark.c --- Found Nothing
    syscalls.h --- Found Nothing
    testcrc32.c --- Found Nothing
    42 --- Found Nothing
    ls --- Found Nothing
    ps --- Found Nothing
    a.asm --- Found Nothing
    compile --- Found Nothing
    intro.txt --- Found Nothing
    Makefile --- Found Nothing
    README --- Found Nothing
    virus.c --- Found Nothing
    virus.ld --- Found Nothing
    virus --- Found Nothing
    arian.asm --- Found Nothing
    ChangeLog --- Found Nothing
    COPYING --- Found Nothing
    infect.asm --- Found Nothing
    Makefile --- Found Nothing
    misc.asm --- Found Nothing
    README --- Found Nothing
    TODO --- Found Nothing
    ari.inc --- Found Nothing
    constants.inc --- Found Nothing
    lzw.inc --- Found Nothing
    macros.inc --- Found Nothing
    Menuet.Oxymoron --- Menuet-B
    Menuet.Oxymoron.txt --- Found Nothing
    code.asm --- Found Nothing
    tristesse --- Menuet

< AVIRA >
    4096.asm --- Found Nothing
    balrog.asm --- Found Nothing
    Changelog --- Found Nothing
    debug.c --- Found Nothing
    layer1.c --- Found Nothing
    layer2.c --- Found Nothing
    Makefile --- Found Nothing
    README --- Found Nothing
    set_mark.c --- Found Nothing
    syscalls.h --- Found Nothing
    testcrc32.c --- Found Nothing
    42 --- Found Nothing
    ls --- LINUX/Piltot.A.1
    ps --- HEUR/ELF.Malformed
    a.asm --- Found Nothing
    compile --- Found Nothing
    intro.txt --- Found Nothing
    Makefile --- Found Nothing
    README --- Found Nothing
    virus.c --- Found Nothing
    virus.ld --- Found Nothing
    virus --- LINUX/Ranfyg.A.2
    arian.asm --- Found Nothing
    ChangeLog --- Found Nothing
    COPYING --- Found Nothing
    infect.asm --- Found Nothing
    Makefile --- Found Nothing
    misc.asm --- Found Nothing
    README --- Found Nothing
    TODO --- Found Nothing
    ari.inc --- Found Nothing
    constants.inc --- Found Nothing
    lzw.inc --- Found Nothing
    macros.inc --- Found Nothing
    Menuet.Oxymoron --- MenuetOS.Oxymoron
    Menuet.Oxymoron.txt --- HTML/Silly.Gen
    code.asm --- HTML/Silly.Gen
    tristesse --- MenuetOS.Tristess

< a-squared >
    4096.asm --- Found Nothing
    balrog.asm --- Found Nothing
    Changelog --- Found Nothing
    debug.c --- Found Nothing
    layer1.c --- Found Nothing
    layer2.c --- Found Nothing
    Makefile --- Found Nothing
    README --- Found Nothing
    set_mark.c --- Found Nothing
    syscalls.h --- Found Nothing
    testcrc32.c --- Found Nothing
    42 --- Found Nothing
    ls --- Linux.Piltot.A.1!IK
    ps --- Found Nothing
    a.asm --- Found Nothing
    compile --- Found Nothing
    intro.txt --- Found Nothing
    Makefile --- Found Nothing
    README --- Found Nothing
    virus.c --- Found Nothing
    virus.ld --- Found Nothing
    virus --- Linux.Ranfyg!IK
    arian.asm --- Found Nothing
    ChangeLog --- Found Nothing
    COPYING --- Found Nothing
    infect.asm --- Found Nothing
    Makefile --- Found Nothing
    misc.asm --- Found Nothing
    README --- Found Nothing
    TODO --- Found Nothing
    ari.inc --- Found Nothing
    constants.inc --- Found Nothing
    lzw.inc --- Found Nothing
    macros.inc --- Found Nothing
    Menuet.Oxymoron --- Virus.Menuet.Xymo.a!IK
    Menuet.Oxymoron.txt --- Found Nothing
    code.asm --- Found Nothing
    tristesse --- Virus.Menuet.Tristesse.A!IK

< BitDefender >
    4096.asm --- Found Nothing
    balrog.asm --- Found Nothing
    Changelog --- Found Nothing
    debug.c --- Found Nothing
    layer1.c --- Found Nothing
    layer2.c --- Found Nothing
    Makefile --- Found Nothing
    README --- Found Nothing
    set_mark.c --- Found Nothing
    syscalls.h --- Found Nothing
    testcrc32.c --- Found Nothing
    42 --- Found Nothing
    ls --- Found Nothing
    ps --- Found Nothing
    a.asm --- Found Nothing
    compile --- Found Nothing
    intro.txt --- Found Nothing
    Makefile --- Found Nothing
    README --- Found Nothing
    virus.c --- Found Nothing
    virus.ld --- Found Nothing
    virus --- Linux.Ranfyg
    arian.asm --- Found Nothing
    ChangeLog --- Found Nothing
    COPYING --- Found Nothing
    infect.asm --- Found Nothing
    Makefile --- Found Nothing
    misc.asm --- Found Nothing
    README --- Found Nothing
    TODO --- Found Nothing
    ari.inc --- Found Nothing
    constants.inc --- Found Nothing
    lzw.inc --- Found Nothing
    macros.inc --- Found Nothing
    Menuet.Oxymoron --- Menuet.Xymo.Z
    Menuet.Oxymoron.txt --- Found Nothing
    code.asm --- Found Nothing
    tristesse --- Menuet.ComTrist.A

< GuangHua >
    4096.asm --- Found Nothing
    balrog.asm --- Found Nothing
    Changelog --- Found Nothing
    debug.c --- Found Nothing
    layer1.c --- Found Nothing
    layer2.c --- Found Nothing
    Makefile --- Found Nothing
    README --- Found Nothing
    set_mark.c --- Found Nothing
    syscalls.h --- Found Nothing
    testcrc32.c --- Found Nothing
    42 --- Found Nothing
    ls --- Found Nothing
    ps --- Found Nothing
    a.asm --- Found Nothing
    compile --- Found Nothing
    intro.txt --- Found Nothing
    Makefile --- Found Nothing
    README --- Found Nothing
    virus.c --- Found Nothing
    virus.ld --- Found Nothing
    virus --- Found Nothing
    arian.asm --- Found Nothing
    ChangeLog --- Found Nothing
    COPYING --- Found Nothing
    infect.asm --- Found Nothing
    Makefile --- Found Nothing
    misc.asm --- Found Nothing
    README --- Found Nothing
    TODO --- Found Nothing
    ari.inc --- Found Nothing
    constants.inc --- Found Nothing
    lzw.inc --- Found Nothing
    macros.inc --- Found Nothing
    Menuet.Oxymoron --- Found Nothing
    Menuet.Oxymoron.txt --- Found Nothing
    code.asm --- Found Nothing
    tristesse --- MeOS.Tristess

< Ikarus >
    4096.asm --- Found Nothing
    balrog.asm --- Found Nothing
    Changelog --- Found Nothing
    debug.c --- Found Nothing
    layer1.c --- Found Nothing
    layer2.c --- Found Nothing
    Makefile --- Found Nothing
    README --- Found Nothing
    set_mark.c --- Found Nothing
    syscalls.h --- Found Nothing
    testcrc32.c --- Found Nothing
    42 --- Found Nothing
    ls --- Linux.Piltot.A.1
    ps --- Found Nothing
    a.asm --- Found Nothing
    compile --- Found Nothing
    intro.txt --- Found Nothing
    Makefile --- Found Nothing
    README --- Found Nothing
    virus.c --- Found Nothing
    virus.ld --- Found Nothing
    virus --- Linux.Ranfyg
    arian.asm --- Found Nothing
    ChangeLog --- Found Nothing
    COPYING --- Found Nothing
    infect.asm --- Found Nothing
    Makefile --- Found Nothing
    misc.asm --- Found Nothing
    README --- Found Nothing
    TODO --- Found Nothing
    ari.inc --- Found Nothing
    constants.inc --- Found Nothing
    lzw.inc --- Found Nothing
    macros.inc --- Found Nothing
    Menuet.Oxymoron --- Virus.Menuet.Xymo.a
    Menuet.Oxymoron.txt --- Found Nothing
    code.asm --- Found Nothing
    tristesse --- Virus.Menuet

< McAfee >
    4096.asm --- Found Nothing
    balrog.asm --- Found Nothing
    Changelog --- Found Nothing
    debug.c --- Found Nothing
    layer1.c --- Found Nothing
    layer2.c --- Found Nothing
    Makefile --- Found Nothing
    README --- Found Nothing
    set_mark.c --- Found Nothing
    syscalls.h --- Found Nothing
    testcrc32.c --- Found Nothing
    42 --- Found Nothing
    ls --- Found Nothing
    ps --- Found Nothing
    a.asm --- Found Nothing
    compile --- Found Nothing
    intro.txt --- Found Nothing
    Makefile --- Found Nothing
    README --- Found Nothing
    virus.c --- Found Nothing
    virus.ld --- Found Nothing
    virus --- Found Nothing
    arian.asm --- Found Nothing
    ChangeLog --- Found Nothing
    COPYING --- Found Nothing
    infect.asm --- Found Nothing
    Makefile --- Found Nothing
    misc.asm --- Found Nothing
    README --- Found Nothing
    TODO --- Found Nothing
    ari.inc --- Found Nothing
    constants.inc --- Found Nothing
    lzw.inc --- Found Nothing
    macros.inc --- Found Nothing
    Menuet.Oxymoron --- MeOS/Xymo virus
    Menuet.Oxymoron.txt --- Univ.script/99a virus
    code.asm --- Univ.script/99a virus
    tristesse --- MeOS/Tristess virus

< Norman >
    4096.asm --- Found Nothing
    balrog.asm --- Found Nothing
    Changelog --- Found Nothing
    debug.c --- Found Nothing
    layer1.c --- Found Nothing
    layer2.c --- Found Nothing
    Makefile --- Found Nothing
    README --- Found Nothing
    set_mark.c --- Found Nothing
    syscalls.h --- Found Nothing
    testcrc32.c --- Found Nothing
    42 --- Found Nothing
    ls --- Found Nothing
    ps --- Found Nothing
    a.asm --- Found Nothing
    compile --- Found Nothing
    intro.txt --- Found Nothing
    Makefile --- Found Nothing
    README --- Found Nothing
    virus.c --- Found Nothing
    virus.ld --- Found Nothing
    virus --- Found Nothing
    arian.asm --- Found Nothing
    ChangeLog --- Found Nothing
    COPYING --- Found Nothing
    infect.asm --- Found Nothing
    Makefile --- Found Nothing
    misc.asm --- Found Nothing
    README --- Found Nothing
    TODO --- Found Nothing
    ari.inc --- Found Nothing
    constants.inc --- Found Nothing
    lzw.inc --- Found Nothing
    macros.inc --- Found Nothing
    Menuet.Oxymoron --- Virus MenuetOS/Xymo.A
    Menuet.Oxymoron.txt --- Found Nothing
    code.asm --- Found Nothing
    tristesse --- Virus MenuetOS/Tristesse.A

< Sophos >
    4096.asm --- Found Nothing
    balrog.asm --- Found Nothing
    Changelog --- Found Nothing
    debug.c --- Found Nothing
    layer1.c --- Found Nothing
    layer2.c --- Found Nothing
    Makefile --- Found Nothing
    README --- Found Nothing
    set_mark.c --- Found Nothing
    syscalls.h --- Found Nothing
    testcrc32.c --- Found Nothing
    42 --- Found Nothing
    ls --- Found Nothing
    ps --- Found Nothing
    a.asm --- Found Nothing
    compile --- Found Nothing
    intro.txt --- Found Nothing
    Makefile --- Found Nothing
    README --- Found Nothing
    virus.c --- Found Nothing
    virus.ld --- Found Nothing
    virus --- Found Nothing
    arian.asm --- Found Nothing
    ChangeLog --- Found Nothing
    COPYING --- Found Nothing
    infect.asm --- Found Nothing
    Makefile --- Found Nothing
    misc.asm --- Found Nothing
    README --- Found Nothing
    TODO --- Found Nothing
    ari.inc --- Found Nothing
    constants.inc --- Found Nothing
    lzw.inc --- Found Nothing
    macros.inc --- Found Nothing
    Menuet.Oxymoron --- Menuet/Xymo-A
    Menuet.Oxymoron.txt --- Found Nothing
    code.asm --- Found Nothing
    tristesse --- Found Nothing

< TrendMicro >
    4096.asm --- Found Nothing
    balrog.asm --- Found Nothing
    Changelog --- Found Nothing
    debug.c --- Found Nothing
    layer1.c --- Found Nothing
    layer2.c --- Found Nothing
    Makefile --- Found Nothing
    README --- Found Nothing
    set_mark.c --- Found Nothing
    syscalls.h --- Found Nothing
    testcrc32.c --- Found Nothing
    42 --- Found Nothing
    ls --- Found Nothing
    ps --- Found Nothing
    a.asm --- Found Nothing
    compile --- Found Nothing
    intro.txt --- Found Nothing
    Makefile --- Found Nothing
    README --- Found Nothing
    virus.c --- Found Nothing
    virus.ld --- Found Nothing
    virus --- Found Nothing
    arian.asm --- Found Nothing
    ChangeLog --- Found Nothing
    COPYING --- Found Nothing
    infect.asm --- Found Nothing
    Makefile --- Found Nothing
    misc.asm --- Found Nothing
    README --- Found Nothing
    TODO --- Found Nothing
    ari.inc --- Found Nothing
    constants.inc --- Found Nothing
    lzw.inc --- Found Nothing
    macros.inc --- Found Nothing
    Menuet.Oxymoron --- MENUETVIR
    Menuet.Oxymoron.txt --- Found Nothing
    code.asm --- Found Nothing
    tristesse --- MENUETVIR

< VBA32 >
    4096.asm --- Found Nothing
    balrog.asm --- Found Nothing
    Changelog --- Found Nothing
    debug.c --- Found Nothing
    layer1.c --- Found Nothing
    layer2.c --- Found Nothing
    Makefile --- Found Nothing
    README --- Found Nothing
    set_mark.c --- Found Nothing
    syscalls.h --- Found Nothing
    testcrc32.c --- Found Nothing
    42 --- Found Nothing
    ls --- Found Nothing
    ps --- Found Nothing
    a.asm --- Found Nothing
    compile --- Found Nothing
    intro.txt --- Found Nothing
    Makefile --- Found Nothing
    README --- Found Nothing
    virus.c --- Found Nothing
    virus.ld --- Found Nothing
    virus --- Found Nothing
    arian.asm --- Found Nothing
    ChangeLog --- Found Nothing
    COPYING --- Found Nothing
    infect.asm --- Found Nothing
    Makefile --- Found Nothing
    misc.asm --- Found Nothing
    README --- Found Nothing
    TODO --- Found Nothing
    ari.inc --- Found Nothing
    constants.inc --- Found Nothing
    lzw.inc --- Found Nothing
    macros.inc --- Found Nothing
    Menuet.Oxymoron --- Virus.Menuet.Xymo.a
    Menuet.Oxymoron.txt --- Found Nothing
    code.asm --- Found Nothing
    tristesse --- Virus.Menuet.Tristesse.a

< ClamWin >
    4096.asm --- Found Nothing
    balrog.asm --- Found Nothing
    Changelog --- Found Nothing
    debug.c --- Found Nothing
    layer1.c --- Found Nothing
    layer2.c --- Found Nothing
    Makefile --- Found Nothing
    README --- Found Nothing
    set_mark.c --- Found Nothing
    syscalls.h --- Found Nothing
    testcrc32.c --- Found Nothing
    42 --- Found Nothing
    ls --- Found Nothing
    ps --- Found Nothing
    a.asm --- Found Nothing
    compile --- Found Nothing
    intro.txt --- Found Nothing
    Makefile --- Found Nothing
    README --- Found Nothing
    virus.c --- Found Nothing
    virus.ld --- Found Nothing
    virus --- Found Nothing
    arian.asm --- Found Nothing
    ChangeLog --- Found Nothing
    COPYING --- Found Nothing
    infect.asm --- Found Nothing
    Makefile --- Found Nothing
    misc.asm --- Found Nothing
    README --- Found Nothing
    TODO --- Found Nothing
    ari.inc --- Found Nothing
    constants.inc --- Found Nothing
    lzw.inc --- Found Nothing
    macros.inc --- Found Nothing
    Menuet.Oxymoron --- Menuet.Oxymoron
    Menuet.Oxymoron.txt --- Found Nothing
    code.asm --- Found Nothing
    tristesse --- Found Nothing

< F-Port >
    4096.asm --- Found Nothing
    balrog.asm --- Found Nothing
    Changelog --- Found Nothing
    debug.c --- Found Nothing
    layer1.c --- Found Nothing
    layer2.c --- Found Nothing
    Makefile --- Found Nothing
    README --- Found Nothing
    set_mark.c --- Found Nothing
    syscalls.h --- Found Nothing
    testcrc32.c --- Found Nothing
    42 --- Found Nothing
    ls --- Found Nothing
    ps --- Found Nothing
    a.asm --- Found Nothing
    compile --- Found Nothing
    intro.txt --- Found Nothing
    Makefile --- Found Nothing
    README --- Found Nothing
    virus.c --- Found Nothing
    virus.ld --- Found Nothing
    virus --- Found Nothing
    arian.asm --- Found Nothing
    ChangeLog --- Found Nothing
    COPYING --- Found Nothing
    infect.asm --- Found Nothing
    Makefile --- Found Nothing
    misc.asm --- Found Nothing
    README --- Found Nothing
    TODO --- Found Nothing
    ari.inc --- Found Nothing
    constants.inc --- Found Nothing
    lzw.inc --- Found Nothing
    macros.inc --- Found Nothing
    Menuet.Oxymoron --- Malware!96ae (exact)
    Menuet.Oxymoron.txt --- Found Nothing
    code.asm --- Found Nothing
    tristesse --- Found Nothing

< Panda >
    4096.asm --- Found Nothing
    balrog.asm --- Found Nothing
    Changelog --- Found Nothing
    debug.c --- Found Nothing
    layer1.c --- Found Nothing
    layer2.c --- Found Nothing
    Makefile --- Found Nothing
    README --- Found Nothing
    set_mark.c --- Found Nothing
    syscalls.h --- Found Nothing
    testcrc32.c --- Found Nothing
    42 --- Found Nothing
    ls --- Found Nothing
    ps --- Found Nothing
    a.asm --- Found Nothing
    compile --- Found Nothing
    intro.txt --- Found Nothing
    Makefile --- Found Nothing
    README --- Found Nothing
    virus.c --- Found Nothing
    virus.ld --- Found Nothing
    virus --- Found Nothing
    arian.asm --- Found Nothing
    ChangeLog --- Found Nothing
    COPYING --- Found Nothing
    infect.asm --- Found Nothing
    Makefile --- Found Nothing
    misc.asm --- Found Nothing
    README --- Found Nothing
    TODO --- Found Nothing
    ari.inc --- Found Nothing
    constants.inc --- Found Nothing
    lzw.inc --- Found Nothing
    macros.inc --- Found Nothing
    Menuet.Oxymoron --- Menuet/Xymo.A
    Menuet.Oxymoron.txt --- Found Nothing
    code.asm --- Found Nothing
    tristesse --- Found Nothing

promised

原帖由 jimmyleo 于 2009-7-1 12:44 发表

传说中的AjLL