35 lines
1.1 KiB
C#
35 lines
1.1 KiB
C#
using Moonlight.App.Database.Entities;
|
|
using Moonlight.App.Models.Misc;
|
|
using Moonlight.App.Services;
|
|
|
|
namespace Moonlight.App.MalwareScans;
|
|
|
|
public class MinerScan : MalwareScan
|
|
{
|
|
public override string Name => "Miner (NEZHA)";
|
|
public override string Description => "Probably a miner";
|
|
public override async Task<MalwareScanResult?> Scan(Server server, IServiceProvider serviceProvider)
|
|
{
|
|
var serverService = serviceProvider.GetRequiredService<ServerService>();
|
|
|
|
var access = await serverService.CreateFileAccess(server, null!);
|
|
var files = await access.Ls();
|
|
|
|
foreach (var file in files.Where(x => x.IsFile && x.Name.EndsWith(".sh")))
|
|
{
|
|
var content = await access.Read(file);
|
|
|
|
if (content.ToLower().Contains("nezha"))
|
|
{
|
|
return new()
|
|
{
|
|
Title = "Miner",
|
|
Description = "Miner start script (NEZHA)",
|
|
Author = "Marcel Baumgartner"
|
|
};
|
|
}
|
|
}
|
|
|
|
return null;
|
|
}
|
|
} |