rfxn/linux-malware-detect

Malware name not always logged to the quarantine history

Gazoo opened this issue · 0 comments

Gazoo commented

In my testing sometimes the malware name seems to missing from the /usr/local/maldetect/sess/quarantine.hist randomly.

To replicate:

Download the sample malware collection from below into a web directory and run a maldet scan on it then quarantine the detected malware:

https://github.com/marcocesarato/PHP-Malware-Collection/archive/refs/heads/master.zip

Then look inside the /usr/local/maldetect/sess/quarantine.hist and you will see that some malware names are empty ( just search for two colons :: )

It seems to be random as you can run multiple scans and sometimes different entries will be missing the malware name.
quarantine.hist.txt