mwp-scan-malware

Installation

Yara Python for Loki

apt-get install python3-yara python3-psutil python3-netaddr python3-pip
pip3 install rfc5424-logging-handler

Sample Formatting

MM-DD-YYYY-originalfilename.php

Todo

1. Mimic verify checksums wp-cli or fix/address.
2. Look for potential files that shouldn't exist, similar to #1
3. Recently modified files.

Improvments

Yara Rules

• https://github.com/nbs-system/php-malware-finder

Scanners

• https://github.com/Neo23x0/Loki + https://github.com/Neo23x0/signature-base

Potential Samples

• https://gist.github.com/jonaslejon
• https://www.wordfence.com/intelligence-documentation/v2-accessing-and-using-the-malware-signature-feed/