https://www.botnets.fr/index.php?action=history&feed=atom&title=Malicious_Apache_module_used_for_content_injection%3A_Linux%2FChapro.AMalicious Apache module used for content injection: Linux/Chapro.A - Revision history2026-10-24T11:03:59ZRevision history for this page on the wikiMediaWiki 1.43.11https://www.botnets.fr/index.php?title=Malicious_Apache_module_used_for_content_injection:_Linux/Chapro.A&diff=2754&oldid=prevEric.freyssinet: 1 revision imported2015-02-07T14:29:18Z<p>1 revision imported</p>
<table style="background-color: #fff; color: #202122;" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="en">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 14:29, 7 February 2015</td>
</tr><tr><td colspan="4" class="diff-notice" lang="en"><div class="mw-diff-empty">(No difference)</div>
</td></tr>
<!-- diff cache key wiki:diff:1.41:old-2753:rev-2754 -->
</table>Eric.freyssinethttps://www.botnets.fr/index.php?title=Malicious_Apache_module_used_for_content_injection:_Linux/Chapro.A&diff=2753&oldid=prevEric.freyssinet at 12:04, 22 December 20122012-12-22T12:04:47Z<p></p>
<p><b>New page</b></p><div>{{Publication<br />
|Type=Blogpost<br />
|Link=http://blog.eset.com/2012/12/18/malicious-apache-module-used-for-content-injection-linuxchapro-a blog.eset.com<br />
|Author=Pierre-Marc Bureau<br />
|NomRevue=ESET Threat Blog<br />
|Date=2012-12-20<br />
|Editor=ESET<br />
|Year=2012<br />
|Malware=Chapro<br />
|ExploitKit=Sweet Orange<br />
|Abstract=More than half of all web servers on the Internet use Apache, so when we discovered a malicious Apache module in the wild last month, being used to inject malicious content into web pages displayed by compromised web servers, we were understandably concerned. Our concern deepened when we discovered that this malware was being used in a scheme to steal banking credentials.<br />
<br />
At first, we wondered if this code might be related to the Linux/[[Snasko]].A rootkit reported to the Full-Disclosure mailing list and then analyzed by CrowdStrike and Kaspersky but it turns out this is a completely different beast.<br />
}}</div>Eric.freyssinet