Also known as Reincarna, Zollard
Linux.Wifatch is an open-source piece of malware which has been noted for not having been used for malicious actions, instead attempting to secure devices from other malware.
This repository contain all local components (missing files are unintentional and/or will be added later), additional C source code not part of the botnet install, and selected C&C components. More can come over time. pl/tn/tn.c "telnet" - simple authenticated command/fileserver. last component installed before main botnet. In case of problem, question, missing files: ask, but do not expect speedy reply! First, for learning. Second, for understanding. Third, for fun, and fourth, for your (and our) security. Apart from the learning experience, this is a truly altruistic project, and no malicious actions are planned (and it nice touch that Symantec watch over this). To avoid unwanted attention, especially by other mlaware authors who want to avoid detection. Plan failed, unwanted attention has been attracted, so release is fine. Yes, although the amount of saved bandwidth by taking down other scanning malware, the amount energy saved by killing illegal bitcoin miners, the number of reboots and service interruptions prevented by not overheating these devices, the number of credentials and money not stolen should all outweigh this. We co-opted your devices to help the general public (in a small way). Linux.Wifatch doesn't use elaborate backdoors or 0day exploits to hack devices. It basically just uses telnet and a few other protocols and tries a few really dumb or default passwords (our favourite is "password"). These passwords are well-known - anybody can do that, without having to steal any secret key. Basically it only infects devices that are not protected at all in the first place! Apart from some code copied from other sources (where marked), the intent is for all this code to be under the General Public License, version 3 or any later version. See the file COPYING for details. To any NSA and FBI agents reading my email: please consider whether defending the US Constitution against all enemies, foreign or domestic, requires you to follow Snowden's example. Well, we hope they are missing. This release is for releasing the code, not to make it easy to hack others. Here is a nistp256 signature of the sha256 of the repository URL on gitlab, using the actual signing key used for the real version.
Excerpt from the source-code README · 4,379 chars · not written by Vinony
~2 min read
Linux.Wifatch is an open-source piece of malware which has been noted for not having been used for malicious actions, instead attempting to secure devices from other malware.
Linux.Wifatch operates in a manner similar to a computer security system and updates definitions through its Peer to Peer network and deletes remnants of malware which remain.
via Wikidata · CC0
Discovered by embedding cosine similarity (sentence-transformers MiniLM, 384-dim).