YARA.eval_post.UNOFFICIAL
-
For some time now, maybe a month or two, I have been getting reports from maldet from my server (dedicated server, WHM/cPanel, CENTOS 7.6, everything up to date) to the effect that maldet has found a suspicious file.
There are several domains on this server and it only seems to be happening on one of the domains, so initially I assumed it was a problem with that domain.
However, multiple scans on the domain with two different malware scanners have never found any malware except the Updraft backup file. No malware in the public space or the entire account space, just in the /wp-content/updraft/backup_2019-08-23-0024_{account name}-db.gz file. I had tech support also double check and they found nothing flagged except the Updraft backup. VirusTotal finds nothing on the domain (https://www.virustotal.com/gui/home/url).
maldet is identifying this file hit list: {YARA}eval_post : /home/{account name}/public_html/wp-content/updraft/backup_2019-08-23-0024_{account name}_43c3635f0104-db.gz and the specific file is YARA.eval_post.UNOFFICIAL
It is basically happening with every backup. Occasionally, it skips a day but not often.
Now I know this has been reported as a false positive for maldet and clamav in the past (if clamav is installed, maldet will use the clamav scanner engine) but that doesn’t address the issue of:
1. why does it only flag the Updraft backup file? what about that backup file is triggering maldet to flag it?
2. I have 16+ domains/accounts on this server. Why is it only flagging one account?
Any suggestions?
- The topic ‘YARA.eval_post.UNOFFICIAL’ is closed to new replies.
