Malware Detection

[KGIII]

I install lots of software, but Build-essential does not ring any bells in my memory.

That's really only needed when you are building software from source.

One 'common' use would be the VirtualBox tools. If you get into virtualizing OSes, you may run into that.

 

[Condobloke]

That's really only needed when you are building software from source.

One 'common' use would be the VirtualBox tools. If you get into virtualizing OSes, you may run into that.

And none of that is on my radar either. I avoid VM stuff of all types, and building soiftware from source is definitely not gonna happen.

I uninstalled it.

Unsure whether to chase it or let it go

 

[KGIII]

Unsure whether to chase it or let it go

Any remnants will be harmless.

I avoid VM stuff of all types

I like VMs, at least when they're useful. They let me test. They let me try other OSes. In fact, they even let me check the validity of solutions that I propose (from time to time). So, they're useful for me.

They do take up some resources. So, yeah, I could understand not using them. They can also have a learning curve. For that, I see VirtualBox or VMware as the best options. They're fairly intuitive, have a handy GUI, and they make features easily available.

I doubt that most people need either of those things. They don't need virtualization, and they don't need to build software from source. Building software from source can be fun. I have a weird fascination with watching the process, as text scrolls by in the terminal.

 

[Mike-BTU]

I mostly used Virtualbox to run Windows in Linux. But we no longer have a need for Windows.

Windows XP Pro was actually faster in that VM than when running as the sole OS!

 

[craigevil]

https://github.com/VirusTotal/yara-x can be installed using rust/cargo

cargo install yara-x-cli

Then the executable is yr.

yr --help
YARA-X 1.19.0, the pattern matching swiss army knife.

Victor M. Alvarez <[email protected]>

Usage:
  yr [OPTIONS] <COMMAND>

Commands:
  scan        Scan a file or directory
  compile     Compile rules to binary form
  dump        Show the data produced by YARA modules for a file
  fmt         Format YARA source files
  fix         Utilities for fixing source code
  completion  Output shell completion code for the specified shell
  deps        Show rule dependencies
  help        Print this message or the help of the given subcommand(s)

Options:
  -C, --config <CONFIG_FILE>
          Config file for YARA-X
          
          Specifies a config file which controls the behavior of YARA-X. If config file is not
          specified, ${HOME}/.yara-x.toml is used. If it does not exist the default options are
          applied.
          
          See https://virustotal.github.io/yara-x/docs/cli/config-file/ for supported options.

  -h, --help
          Print help (see a summary with '-h')

  -V, --version
          Print version

 

[Rocky10x1]

If you're hitting detection issues, weird behavior, or loading errors with custom rules after a recent update, it's due to major internal changes in compiler semantics regarding string pattern flags (ab6ed6ff & 0305089c)
A repo update and a rebuild resolve the issue.

git log -n 6 --oneline
818af03f (HEAD -> main, origin/main, origin/HEAD) feat: add support for OLECF version 4 files.
4fc35c7b refactor: optimize OLECF stream data retrieval. (#700)
cf9f986b style: fix clippy warnings.
0cc1fc5e tests: fix broken tests.
0305089c chore: bump SERIALIZATION_VERSION as the semantics of pattern flags has changed.
ab6ed6ff refactor: replace the `Ascii` and `Wide` pattern flags with `WideOnly` and `WideAndAscii`

 

[//////]

here is interesting autopsy of Linux RAT.

 

[Rocky10x1]

here is interesting autopsy of Linux RAT.

Thanks. Really interesting, but also pretty alarming stuff. The dropper mechanism via AppImage is especially nasty, since the malware is statically "clean," traditional signature scans (like VirusTotal or static Yara) are completely blind to it.

Since dropper has to phone home to grab payload, strict egress filtering is the way to go. I’ve configured my nftables to clamp down on large uploads to kill potential data exfiltration and session hijacking attempts.
Here is a quick rule example for dealing with AppImage..

groupadd block-internet

table inet filter {
    chain output {
        type filter hook output priority filter; policy accept;
        skgid block-internet reject with icmp type admin-prohibited
    }
}

Then just run it like this > sg block-internet -c "./malware-2.7.4.AppImage"
Or even easier > firejail --net=none "./malware-2.7.4.AppImage"

I’d be curious to hear how everyone else here handles this. Personally, I run Arch, but I keep it strictly to official repos and tools/scripts I’ve developed myself. No AUR, no Flatpak, no AppImages, and absolutely no third-party scripts.

 

[//////]

I’d be curious to hear how everyone else here handles this. Personally, I run Arch, but I keep it strictly to official repos and tools/scripts I’ve developed myself. No AUR, no Flatpak, no AppImages, and absolutely no third-party scripts.

same here, no AUR, no Flatpak, no AppImages.

i use blocklists, like :

my @BLOCKLIST_FEEDS = (
    { label => 'FireHOL Level 1',  type => 'ipset',
      url   => 'https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level1.netset' },
    { label => 'HaGeZi TIF',       type => 'ipset',
      url   => 'https://raw.githubusercontent.com/hagezi/dns-blocklists/refs/heads/main/ips/tif.txt' },
    { label => 'Feodo Tracker C2', type => 'ipset', auth => 1,
      url   => 'https://feodotracker.abuse.ch/downloads/ipblocklist_recommended.txt' },
    { label => 'URLhaus IP URLs',  type => 'urls', auth => 1,
      url   => 'https://urlhaus.abuse.ch/downloads/text_online/' },
    { label => 'Spamhaus DROP',    type => 'spamhaus_json',
      url   => 'https://www.spamhaus.org/drop/drop_v4.json' },
    { label => 'Spamhaus DROPv6',  type => 'spamhaus_json',
      url   => 'https://www.spamhaus.org/drop/drop_v6.json' },
    { label => 'ThreatFox ip:port', type => 'threatfox_csv', auth => 1,
      url   => 'https://threatfox.abuse.ch/export/csv/ip-port/recent/' },
);

and those are sort / uniq and added to nftables blackhole4 / blackhole6 + i have geoblock also, top 10 malware / etc countries.

US and GB arent blocked cus it would interfere with web browsing too much.

i have few highports allowed for gaming. i need to fine tune my outbound ports to add ip-addresses that are allowed.

 

[f33dm3bits]

I’d be curious to hear how everyone else here handles this. Personally, I run Arch, but I keep it strictly to official repos and tools/scripts I’ve developed myself. No AUR, no Flatpak, no AppImages, and absolutely no third-party scripts.

Since the AUR problem I switched to only using the official repos, a few verified Flatpaks and a few Appimages straight from the the source where the developer has them for people to download.

 

[Rocky10x1]

i use blocklists, like :

Your blocklist setup looks solid, I used to do it that way, too. Nowadays, I rely on DoT via NextDNS. It lets me curate my own stack from dozens of blocklists, and NextDNS adds a few more protection layers on top:

Threat Intelligence Feeds, AI-based threat detection, and Google Safe Browsing, Cryptojacking protection, DNS Rebinding protection, IDN homograph attack protection, and Domain Generation Algorithms protection.

Blocklists > HaGeZi - Multi PRO++, HaGeZi - Multi PRO, and Fanboy's Annoyance List.
----------------

@f33dm3bits

In case you actually do need to use AUR packages occasionally, here is a set of YARA rules created by Marius Benthin that covers some common warning signals:

• Detects suspicious PKGBUILDs with npm dependencies and install scripts.
• Detects suspicious .SRCINFO files with npm dependencies and install scripts.
• Detects suspicious pre- and post-hooks in Arch install files.
• Detects suspicious execution commands in Arch ALPM hooks.

Could be a decent extra layer if you’re not as strict as I am about avoiding AUR.

rule SUSP_LNX_ARCH_PKGBUILD_NPM_Dependency_Jun26 {
   meta:
      description = "Detects suspicious PKGBUILD with NPM dependency and install script"
      author = "Marius Benthin"
      date = "2026-06-15"
      reference = "https://aur.archlinux.org/cgit/aur.git/commit/?h=hearthstone-linux-gui-bin&id=ecf810ac853e7149abd4e0c793b2517e9737edb8"
      reference2 = "https://aur.archlinux.org/cgit/aur.git/commit/?h=python-django-js-asset&id=af09b1cf1b59"
      hash = "56bed7736d44219215fd912b229c7f765b737db4f6cde256ce264e795310c648"
      hash = "1359814fda7f5ef63f04348439bfb011d7abc0381be6fbb404b04b359d63b61b"
      hash = "3e1f297ab4d261fcad14a865a54d049d75d897d549d03371a5c4bbbc6e10e5cd"
      score = 60
   strings:
      // depends=('npm' or 'bun'
      $sa1 = { (0A | 20) 64 65 70 65 6E 64 73 3D 28 [0-15] (6E 70 6D | 62 75 6E) }

      // install -Dm644 "../*.hook"
      $sb1 = { 69 6E 73 74 61 6C 6C 20 2D 44 6D 36 34 34 20 (22 | 27) [0-100] 2E 68 6F 6F 6B (22 | 27) 0A }
      // install=oracle-bin-deps.install
      $sb2 = { 69 6E 73 74 61 6C 6C 3D [1-50] 2E 69 6E 73 74 61 6C 6C }
   condition:
      filesize < 100KB
      and $sa1
      and 1 of ($sb*)
}

rule SUSP_LNX_ARCH_SRCINFO_NPM_Dependency_Jun26 {
   meta:
      description = "Detects suspicious .SRCINFO with NPM dependency and install script"
      author = "Marius Benthin"
      date = "2026-06-15"
      reference = "https://aur.archlinux.org/cgit/aur.git/commit/?h=hearthstone-linux-gui-bin&id=ecf810ac853e7149abd4e0c793b2517e9737edb8"
      hash = "2ee28d5866fdb46e439678ad92729b1cd71d2d871135d8d56a27cf6a6b49e649"
      score = 60
   strings:
      $s1 = "depends = npm\n"
      // install = python-pymilvus-deps.install
      $s2 = { 69 6E 73 74 61 6C 6C 20 3D 20 [1-50] 2E 69 6E 73 74 61 6C 6C }
   condition:
      filesize < 5KB
      and all of them
}

rule SUSP_LNX_ARCH_Install_Hook_Jun26 {
   meta:
      description = "Detects suspicious pre and post hooks in Arch install files"
      author = "Marius Benthin"
      date = "2026-06-15"
      reference = "https://aur.archlinux.org/cgit/aur.git/commit/?h=hearthstone-linux-gui-bin&id=ecf810ac853e7149abd4e0c793b2517e9737edb8"
      reference2 = "https://aur.archlinux.org/cgit/aur.git/commit/?h=python-django-js-asset&id=af09b1cf1b59"
      hash = "47c076099e6715ffb0bd357b6832175741e77b88972033cd1f9b55b6ff7e5519"
      hash = "ef735bca8cb2acafe70831e33ed468a3046a61147af694000761970415c7eef1"
      score = 70
   strings:
      $sa1 = "pre_install() {"
      $sa2 = "post_install() {"
      $sa3 = "pre_upgrade() {"
      $sa4 = "post_upgrade() {"
      $sa5 = "pre_remove() {"
      $sa6 = "post_remove() {"

      $sb1 = "npm install "
      $sb2 = "&& 'b''u''n'"

      $fp1 = "#!/bin/sh"
   condition:
      filesize < 5KB
      and 1 of ($sa*)
      and 1 of ($sb*)
      and not 1 of ($fp*)
}

rule SUSP_LNX_ARCH_ALPM_Hook_Jun26 {
   meta:
      description = "Detects suspicious execution commands in Arch ALPM hooks"
      author = "Marius Benthin"
      date = "2026-06-15"
      reference = "https://aur.archlinux.org/cgit/aur.git/commit/?h=hearthstone-linux-gui-bin&id=ecf810ac853e7149abd4e0c793b2517e9737edb8"
      hash = "ba332432f87e68d7fa8c784c60c39ba0d3e2ac06fd8855e82ea49329e2684529"
      score = 70
   strings:
      $s1 = "[Action]"
      $s2 = "Exec = "
      $s3 = "npm install "
      $s4 = "2>/dev/null"
   condition:
      filesize < 5KB
      and all of them
}

 

[f33dm3bits]

@f33dm3bits

In case you actually do need to use AUR packages occasionally, here is a set of YARA rules created by Marius Benthin that covers some common warning signals:

Thanks! I'm quite good without the AUR and only using official repos, verified Flatpaks and developer made Appimages.

 

[//////]

Your blocklist setup looks solid, I used to do it that way, too. Nowadays, I rely on DoT via NextDNS. It lets me curate my own stack from dozens of blocklists, and NextDNS adds a few more protection layers on top:

thank you

i always had a need for good blocklists. ill check that out to see what kind of lists i can make there.

Edit: i am at https://github.com/nextdns/nextdns/wiki reading it first