[GH-ISSUE #532] Possible Malicious Linux.Xor.DDoS installed #234

Closed
opened 2026-06-08 11:26:16 +03:00 by zhus · 2 comments
Owner

Originally created by @audioscavenger on GitHub (Oct 12, 2025).
Original GitHub issue: https://github.com/bootandy/dust/issues/532

cd /tmp
wget https://github.com/bootandy/dust/releases/download/v1.2.3/dust-v1.2.3-x86_64-unknown-linux-gnu.tar.gz

sudo chkrootkit
Searching for Linux.Xor.DDoS ... INFECTED: Possible Malicious Linux.Xor.DDoS installed
/tmp/dust-v1.2.3-x86_64-unknown-linux-gnu/dust

is this a false positive?

Originally created by @audioscavenger on GitHub (Oct 12, 2025). Original GitHub issue: https://github.com/bootandy/dust/issues/532 cd /tmp wget https://github.com/bootandy/dust/releases/download/v1.2.3/dust-v1.2.3-x86_64-unknown-linux-gnu.tar.gz sudo chkrootkit Searching for Linux.Xor.DDoS ... INFECTED: Possible Malicious Linux.Xor.DDoS installed /tmp/dust-v1.2.3-x86_64-unknown-linux-gnu/dust is this a false positive?
zhus closed this issue 2026-06-08 11:26:16 +03:00
Author
Owner

@bootandy commented on GitHub (Oct 13, 2025):

I hope so.

I have just tried to replicate this and it didn't flag the file as INFECTED.

Does this also happen with v1.2.2 ? Can you upgrade chrootkit ?

<!-- gh-comment-id:3398635643 --> @bootandy commented on GitHub (Oct 13, 2025): I hope so. I have just tried to replicate this and it didn't flag the file as INFECTED. Does this also happen with v1.2.2 ? Can you upgrade chrootkit ?
Author
Owner

@audioscavenger commented on GitHub (Oct 17, 2025):

Man i almost lost my 2TB VPC because it was sending spam, the provider threatened me a little.

chrootkit is latest on ubuntu 20.04 where I installed it. probably false positive but I won't redownload it.
VPC was killed and I reinstalled my sht on a new one. we will never know

<!-- gh-comment-id:3413999742 --> @audioscavenger commented on GitHub (Oct 17, 2025): Man i almost lost my 2TB VPC because it was sending spam, the provider threatened me a little. chrootkit is latest on ubuntu 20.04 where I installed it. probably false positive but I won't redownload it. VPC was killed and I reinstalled my sht on a new one. we will never know
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: bootandy/archived-dust#234