All files with extension psaux

Help! (Home for newbies)
21

Yeah, it sounds like ransom ware but usually that comes with a ransom demand. Well, at least a semi competent axehole crook would figure out the order of the exploit execution. :thinking:

It’s just strange that searches don’t turn anything up. Maybe the extensions are randomized somehow to try and cover tracks? I know I saw a machine try domain after domain trying to phone home once. Most of the domains were random gibberish. One actually announced ‘ransomware’ in the DNS request.

22

Y’all are reading too much into the file extension.

2 Likes
23

For sure it is not related to the phone. This morning I saw that all sites return 404 and when I checked I saw that all files have that extension and cant be loaded as php files.

The first idea was just to remove the extension, but I saw that the content of the files is somehow coded.

Tried to search in google - nothing.

Very strange case.

24

When you said earlier “system files” were affected
but the web server is still running? What system files do you see that are encrypted?

25

For example virtualmin-src.psaux.

Probably my mistake and the system files are not encrypted.

26

That’s an extremely important distinction. If system files are affected in any way, then you know the system has been rooted and has to be reinstalled from scratch. You can never again trust a system that has been rooted.

But, if it’s just one user, then it may just be that one web app that’s exploited. In which case, restoring a known good backup for that one user/domain may be sufficient, as long as you figure out what was exploitable in the old website and fix it (maybe a web app update, or if it’s custom code
well, you’re own your own if it’s custom code).

27

I have found other infected system just googleing readme.md.psaux.

ie https://www.agpgarage.fr/node_modules/mime/

node.js seem common to the sites.

but that maybe the search I did and a coincidence.

28

I wonder which version they were using - it has had some problems recently particular to npm vulnerabilities - another reason why updating and monitoring old systems is important.

1 Like
29

Upload a couple files to VirusTotal and see if they come up with hints what infection it could be.

1 Like
30

Just an update from me.

I tried to upload some files to VirusTotal, but nothing.

I already reinstalled the server and tried to improve the security of the server, so no I’m waiting :D.

31

Thanks for that! so often on here there is no solution or update to issues raised :slight_smile:

did you ever determine if it was a nodejs application? npm package or something else.

32

Proven Data - Free Ransomware Identification Service

and

  • decryption tools available here
  • they also recommend that you scan your computer for virus to prevent re-encryption.

I would recommend

  • you take the system offline
  • copy the data to another drive
  • then work on the copy to decrypt your stuff
  • never put the system back online on an open network.
33

I don’t think it was related to nodejs app because I didn’t have any such apps. Only a few php apps were running.

1 Like
34

Your first screenshot shows a composer file and seem to be setup to pull files, so its not a standard website.

35

@ivanovkbg - thats ransomware - cut all noise and save your time - rebuild your server from scratch and if you used some cms like wordpress or presta or opencard etc, install only latest versions, also ssh only via ssh keys no password. There is no reason you should spend any more time or energy to decrypt the files - even decripted its no use as someone had find way in - remove the files and db too. I am sorry but - Good luck.

psaux = rasnsomware - its been on google long time.

1 Like
36

I already did it - starting with a fresh installation.

On the server there are no sites using those CMSs.

37

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.