Virus

Linux/Tcl.Darkness

Analysis

  • Virus is script-based and appends its code to other files
  • Virus is coded in Tcl, a script-based language primarily for Unix operating systems
  • If the virus script is initiated, it will attempt to first open all files for reading and scan each file for the text "#!/usr/bin/env wish"
  • For every file not containing this text, the virus will open that file for appending and attempt to append its code to that file
  • The virus also modifies the .bashrc environment control file such that text is displayed when a bash command is executed -

    Lying here
    future unclear
    all I know
    before the curtain dropped
    you left the show..

    Shallow water
    rippled by tears
    shallow water
    mirrors my fear
    silent raindrops
    soothen my skin
    still the answers
    stay locked down within

    '(Sylver - Shallow water)'

  • The virus also modifies the .bash_profile configuration file such that the following text is displayed -

    Your world has spikes on his back and he wants to lay down on you
    Don't like what I say, you best not go away
    Take a look into my bag of wonders
    I'll pull out something special just for you
    Don't tell anyone
    It'll be our secret
    A weak and tainted soul I stole from you know who
    You want to buy it back I'll have to charge you for two

    I sell society
    You won't hear lies from me
    I'll tell you everything you want to hear
    I sell society
    You won't hear lies from me
    I'll sell you everything you want to buy

    '(Godhead - I sell society)'

  • The virus script contains the string "#Darkness" in its code