SHARE
TWEET

libworker.so ALIVE sites

MalwareMustDie May 10th, 2014 1,360 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. # MalwareMustDie!
  2. # PoC of Wordpress servers infected by the .so ELF library malware.
  3. # Case: http://blog.malwaremustdie.org/2014/05/elf-shared-so-dynamic-library-malware.html
  4. # Infection is searchable by Google: https://lh5.googleusercontent.com/-O89zet-xRTE/U26bvNzGNKI/AAAAAAAAPu0/Ig_SU2QEvlw/s512/S110101.png
  5. # Overall result is 65 servers now...
  6.  
  7. // Recent (on going search result..)
  8. // $ date
  9. Sun May 11 06:10:14 JST 2014
  10.  
  11. http://ceresbilisim.com/libworker.so
  12. http://cheaphostelvalencia.com/libworker.so
  13. http://www.askhisar.com/libworker.so
  14. http://mehmedzahidkotku.net/libworker.so
  15. http://2slowater.com/libworker.so
  16. http://www.phillymedpros.com/libworker.so
  17. http://www.focusbangalore.com/libworker.so
  18. http://fooladrail.com/libworker.so
  19.  
  20. // new ones:
  21. // @unixfreaxjp ~]$ date
  22. Sun May 11 05:09:13 JST 2014
  23.  
  24. h00p://amiri4efl.com/wordpress/libworker.so
  25. h00p://apibestinclass.net/libworker.so
  26. h00p://bahcesaray.biz/modules/mod_araticlhess/libworker.so
  27. h00p://chupamisto.info/libworker.so
  28. h00p://ciceronrealestate.com/modules/mod_araticlhess/libworker.so
  29. h00p://dl.shia-leaders.com/online-sound-player/libworker.so
  30. h00p://e-tributes.com/libworker.so
  31. h00p://fashionquiari.com/libworker.so
  32. h00p://fatelist.com/libworker.so
  33. h00p://fooladrail.com/libworker.so
  34. h00p://hellasexecom.eu/wp-eu/libworker.so
  35. h00p://ioacquistonline.altervista.org/blog/wp-content/themes/arras/libworker.so
  36. h00p://kokannama.com/wp-content/uploads/2014/03/libworker.so
  37. h00p://kylegoulden.com/wp-includes/js/tinymce/plugins/paste/libworker.so
  38. h00p://masterdecorators.in/libworker.so
  39. h00p://mayadagi.com/modules/mod_araticlhess/libworker.so
  40. h00p://mecsekion.com/store/libworker.so
  41. h00p://netexcomputersandcd.com/libworker.so
  42. h00p://new.oms35.ru/upload/Doc_na2013/V_na_2013/kom_280613/libworker.so
  43. h00p://petrospecbrasil.com/wp-content/uploads/libworker.so
  44. h00p://phuketsoftware.net/wp-content/uploads/libworker.so
  45. h00p://polinamineva.com/wp-content/themes/Bold/libworker.so
  46. h00p://ponpesbaitussaadah.com/wp-content/themes/OurBiz/libworker.so
  47. h00p://promobilya.com/wp-content/themes/FreshAndClean/libworker.so
  48. h00p://ptt-air.com/modules/mod_araticlhess/libworker.so
  49. h00p://queenslandmotels.net/libworker.so
  50. h00p://school.dinatoni.ir/libworker.so
  51. h00p://smilesquaredance.com/libworker.so
  52. h00p://thefacts-free.com/libworker.so
  53. h00p://www.algorytm.org/components/com_comprofiler/plugin/templates/dark/images/lightbox/libworker.so
  54. h00p://www.alimentacao-saudavel.com/wp-content/plugins/maxblogpress-unblockable-popup/editor/themeslibworker.so/advanced/skins/o2k7/img/
  55. h00p://www.andreiszasz.com/Images/High/libworker.so
  56. h00p://www.flexibd.com/libworker.so
  57. h00p://www.interneo.org/libworker.so
  58. h00p://www.lankaran2012.az/wp-content/uploads/2014/01/libworker.so
  59. h00p://www.mfable.com/libworker.so
  60. h00p://www.orggu.com/libworker.so
  61. h00p://www.telechargerfilmsfrancaisgratuit.info/wp-includes/libworker.so
  62. h00p://www.tvcustomers.info/libworker.so
  63.  
  64. // Previous ones...
  65.  
  66. h00p://ioacquistonline.altervista.org/blog/wp-content/themes/arras/libworker.so
  67. h00p://miniradiosolutions.com/wp-content/uploads/libworker.so
  68. h00p://oaosu.ru/includes/libworker.so
  69. h00p://www.risehitus.ee/wp-includes/libworker.so
  70. h00p://redcliffesoftball.com.au/wp-includes/js/tinymce/plugins/wpfullscreen/libworker.so
  71. h00p://miniradiosolutions.com/wp-content/uploads/libworker.so
  72. h00p://www.etikmedikal.com/images/libworker.so
  73. h00p://countrycosmic.co.za/libworker.so
  74. h00p://www.amazonasvive.com/libworker.so
  75. h00p://visualgmt.com/libworker.so
  76. h00p://comousarelinternet.com/minegociointernet.com/libworker.so
  77. h00p://vmacq.com/libworker.so
  78. h00p://www.minegociointernet.com/libworker.so
  79. h00p://www.djvsolutions.com/libworker.so
  80. h00p://giritontro.com/_vti_bin/libworker.so
  81. h00p://tagstrategies.com/libworker.so
  82. h00p://www.igehirdetesek.hu/libworker.so
  83. h00p://kpskw.org.pl/libworker.so
  84.  
  85. ---
  86. #MalwareMustDie!!
RAW Paste Data
Top