New: Mirai Virus ?

https://bugs.busybox.net/show_bug.cgi?id=13396

Bug ID: 13396
Summary: Mirai Virus ?
Product: buildroot
Version: unspecified
Hardware: All
OS: Linux
Status: NEW
Severity: normal
Priority: P5
Component: Other
Assignee: unassigned at buildroot.uclibc.org
Reporter: david.vantyghem at laposte.net
CC: buildroot at uclibc.org
Target Milestone: ---

In
https://www.uclibc.org/downloads/binaries/0.9.30.1/mini-native-x86_64.tar.bz2 , ldconfig could contain the Mirai virus ?
https://www.virustotal.com/gui/file/e3686c960bd29a830c81a5c0396638b73bb7949b3f707fe029d4fbbff9ebe1d4/detection

You are receiving this mail because:
You are on the CC list for the bug.

https://bugs.busybox.net/show_bug.cgi?id=13396

--- Comment #1 from InfoLibre <[email protected]> --- When this version is used, the same virus is then detected in Ventoy :
https://github.com/ventoy/Ventoy/issues/660

You are receiving this mail because:
You are on the CC list for the bug.

https://bugs.busybox.net/show_bug.cgi?id=13396

Yann E. MORIN <[email protected]> changed:

What |Removed |Added
----------------------------------------------------------------------------

                 CC|                            |uclibc-cvs at uclibc.org,
                   |                            |yann.morin.1998 at free.fr
            Product|buildroot                   |uClibc
          Component|Other                       |Other
           Assignee|unassigned at buildroot.uclibc |unassigned at uclibc.org
                   |.org                        |
         Resolution|---                         |INVALID
             Status|NEW                         |RESOLVED

--- Comment #2 from Yann E. MORIN <[email protected]> --- First, uClibc has had no activity since 2015. It's dead and has been replaced with uClibc-ng: https://uclibc-ng.org/. As such, any bug should probably reported there now.

Second, 2015 was before the disclosure of Mirai, and the ldconfig code had anyway not been touched since 2011.

Third, you are referencing a toolchain that was built in April 2009, more than 11 years ago now, so at least seven years before Mirai was discovered. I would wager that this definitely predates Mirai.

I would believe that this is a false positive.

You are receiving this mail because:
You are on the CC list for the bug.

https://bugs.busybox.net/show_bug.cgi?id=13396

--- Comment #3 from InfoLibre <[email protected]> --- Some of the 10 antivirus who detect a malware are saying it's Mirai virus but it could be another malware that is detected as Mirai malware. The problem is that when you use ldconfig, your own software contains the same code after.

You are receiving this mail because:
You are on the CC list for the bug.