5

One of my servers was recently infected with malware (due to the datacentre's service account being compromised, but it's also my fault for not securing the server properly). It has been eradicated but I have screenshots of the malware itself, plus the way it behaved.

Being Information Security SE, can I ask for help identifying the particular malware that my server was infected with? I'm curious from an educational standpoint about what the malware was actually capable of, and the users of Information Security SE will know far better than I do.

On-topic doesn't mention anything specific, but this could come under incident response as by gaining knowledge of what exactly this actually was, I'd be better prepared for it if it does happen again.

2
  • The typical response to such questions is "what does VirusTotal say?"
    – schroeder Mod
    Dec 6, 2016 at 22:34
  • @schroeder I'm talking about post-infection and eradication (i.e, catching it before it does any harm, but wanting to know exactly what it was and what it could have done), not a case of 'is this a virus/malware/whatever'. You're probably right that it would be the typical response.
    – AStopher
    Dec 6, 2016 at 22:36

1 Answer 1

Reset to default
6

This type of question could be on-topic, but I have yet to see one that actually is. The problem is that without the binaries, we would never have enough data to say much. With the binaries, you can use a malware analysis tool (or VirusTotal) to tell you.

As you say that you do not have the binaries, and this is a post-incident wrap-up, I suspect that there is absolutely no way we can tell you everything it could have done that you have not already observed.

That's the great thing about software, it can be programmed to do anything.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .