New virus found that Maldex, CXS, Clam has not detected

[mitchmenghi]

Hello,

We have uncovered a suspicious file that i am overly surprised no scanner has picked up and its very concerning.

The filename is called 'indonesia.php'

I was sitting in one of our customer Wordpress installs and in some sub directories. The contents of the file is as follows.
Moderated Message:

Do not post exploits on these forums

We are in no way experts but that does seem to be malware.

Has anyone seen this before, or how is it that CXS being a paid solution even after a month did not pick this up ???

[ForumAdmin]

If you would like to submit an exploit for consideration you should use the following syntax:

Code: Select all

cxs --wttw /path/to/exploit.php

We will review the file and consider detection for it in the future. If you want to detect it yourself you can use the cxs --xtra [file] syntax with an xtra file (see documentation) to include your own detection for it.