And the latest mass-infection detected using this malware was pointing to Blackhole Exploit Kit with spreading combination of Trojan PWS/Downloader collaborated with FakeAV and/or ZeroAccess malware, exposed in-> here. This was exposed in Malware Don't Drink Coffee blog in-> here.

The bad actor group who is using Darkleech Apache Module is the same bad guys behind the Cryptome infection more than 1 year ago, and LA Times incident a while ago. Following by various anti virus research reports and coverage i.e. And I believe the first english coverage of this malware was written by Unmask Parasites in-> here. Historically, this malware's infection attack was firstly exposed by Unmask Parasites on August 13th, 2012 in-> here and was firstly very detailed disclosed in October 2012 by russian malware researcher in PDF presentation shared at -> here. This malware is already recognized by antivirus products with the reference name of Linux/Chapro.x or other names, you can seek it in Google-> here. Once it is loaded into the system it perform general malicious functionality of: Self injection of compromised server's web pages with the code to redirect victim to the malware sites and Backdoor the compromised server system from the remote access.īefore starting the details of infection it is good to understand the background of malware to be about to discussed in this post:

Malware module was loaded and activated into the Apache web server system by LoadModule command defined in the module configuration file. This definition is written by the latest observation of the large infection case occurred caused by this malware's infection on Linux Apache Web Servers.ĭarkleech Apache Malware Module version (there is also detected an NGNIX version of this malware as per mentioned -> here by Eric Romang) is the malware implemented in Linux OS served with Apache web server with the Apache API interactive module. Malware Definition and Historical Research I thank you for authority who finally approved MalwareMustDie released the know how for this threat by this simple post. With the help of Malware Researchers, & solid coordination with authorities and admins involved we successfully stopped the mass attack of current threat which damaged hundreds of Linux Apache web servers within 2 weeks infection periods.

Apache spyware on mac