User:KJ7RRV/QMFbrick - Revision history

Danct12 at 09:02, 11 December 2021

2021-12-11T09:02:32Z

← Older revision		Revision as of 09:02, 11 December 2021
Line 7:		Line 7:
	* QMFbrick.C: bundled with wlsunset in a Debian package		* QMFbrick.C: bundled with wlsunset in a Debian package

	The trojans have been spread by anonymous download links in the Pine64 ~~and~~ DanctNIX chats.		The trojans have been spread by anonymous download links in the Pine64, DanctNIX, postmarketOS (offtopic), Mobian chats.

	The A variant was tested by Danct12 and is known to use systemd to set a timer to soft-brick the modem and wipe / on the first Wednesday after installation at 20:00 local time.		The A variant was tested by Danct12 and is known to use systemd to set a timer to soft-brick the modem and wipe / on the first Wednesday after installation at 20:00 local time.

KJ7RRV at 17:51, 9 December 2021

2021-12-09T17:51:54Z

← Older revision		Revision as of 17:51, 9 December 2021
Line 9:		Line 9:
	The trojans have been spread by anonymous download links in the Pine64 and DanctNIX chats.		The trojans have been spread by anonymous download links in the Pine64 and DanctNIX chats.

	The A variant was tested by Danct12 is known to use systemd to set a timer to soft-brick the modem and wipe / on the ~~next~~ Wednesday at 20:00 local time.		The A variant was tested by Danct12 and is known to use systemd to set a timer to soft-brick the modem and wipe / on the first Wednesday after installation at 20:00 local time.

	KJ7RRV is currently working on reverse engineering QMFbrick and attempting to write a removal tool, initially focusing on the B variant.		KJ7RRV is currently working on reverse engineering QMFbrick and attempting to write a removal tool, initially focusing on the B variant.

Fxc: Fxc moved page QMFbrick to User:KJ7RRV/QMFbrick: not an article

2021-12-08T19:21:50Z

Fxc moved page QMFbrick to User:KJ7RRV/QMFbrick: not an article

← Older revision

Revision as of 19:21, 8 December 2021

KJ7RRV at 14:40, 8 December 2021

2021-12-08T14:40:15Z

← Older revision		Revision as of 14:40, 8 December 2021
Line 9:		Line 9:
	The trojans have been spread by anonymous download links in the Pine64 and DanctNIX chats.		The trojans have been spread by anonymous download links in the Pine64 and DanctNIX chats.

	The A variant was tested by Danct12 is known to soft-brick the modem and wipe /.		The A variant was tested by Danct12 is known to use systemd to set a timer to soft-brick the modem and wipe / on the next Wednesday at 20:00 local time.

	KJ7RRV is currently working on reverse engineering QMFbrick and attempting to write a removal tool, initially focusing on the B variant.		KJ7RRV is currently working on reverse engineering QMFbrick and attempting to write a removal tool, initially focusing on the B variant.

KJ7RRV at 07:07, 8 December 2021

2021-12-08T07:07:37Z

← Older revision		Revision as of 07:07, 8 December 2021
Line 1:		Line 1:
	'''Trojan:Linux/QMFbrick''' is a family of malware targeting the [[PinePhone]].		'''Trojan:Linux/QMFbrick''' (usually called QMFbrick; sometimes simply called "the PinePhone malware" or "the malware") is a family of malware targeting the [[PinePhone]].

	Three variants are known:		Three variants are known:

KJ7RRV at 07:05, 8 December 2021

2021-12-08T07:05:57Z

← Older revision		Revision as of 07:05, 8 December 2021
Line 14:		Line 14:

	It seems that running "sudo systemctl disable --now shadlow.timer" before 20:00 on a Wednesday (local time) will stop the A variant from doing any damage. This is not guaranteed, however, and it may or may not work with B and C.		It seems that running "sudo systemctl disable --now shadlow.timer" before 20:00 on a Wednesday (local time) will stop the A variant from doing any damage. This is not guaranteed, however, and it may or may not work with B and C.

			It is not known if the malware has any effects if it is disabled before the activation time. Out of an abundance of caution, a phone that has been infected, even if the malware has been disabled, should not be considered trustworthy.

KJ7RRV at 05:39, 8 December 2021

2021-12-08T05:39:56Z

← Older revision		Revision as of 05:39, 8 December 2021
Line 12:		Line 12:

	KJ7RRV is currently working on reverse engineering QMFbrick and attempting to write a removal tool, initially focusing on the B variant.		KJ7RRV is currently working on reverse engineering QMFbrick and attempting to write a removal tool, initially focusing on the B variant.

			It seems that running "sudo systemctl disable --now shadlow.timer" before 20:00 on a Wednesday (local time) will stop the A variant from doing any damage. This is not guaranteed, however, and it may or may not work with B and C.

KJ7RRV: Created page with "'''Trojan:Linux/QMFbrick''' is a family of malware targeting the PinePhone. Three variants are known: * QMFbrick.A: bundled with a Snake game in an Arch package * QMFbri..."

2021-12-08T04:51:56Z

Created page with "'''Trojan:Linux/QMFbrick''' is a family of malware targeting the PinePhone. Three variants are known: * QMFbrick.A: bundled with a Snake game in an Arch package * QMFbri..."

New page

'''Trojan:Linux/QMFbrick''' is a family of malware targeting the [[PinePhone]].

Three variants are known:

* QMFbrick.A: bundled with a Snake game in an Arch package
* QMFbrick.B: bundled with wlsunset in an Arch package
* QMFbrick.C: bundled with wlsunset in a Debian package

The trojans have been spread by anonymous download links in the Pine64 and DanctNIX chats.

The A variant was tested by Danct12 is known to soft-brick the modem and wipe /.

KJ7RRV is currently working on reverse engineering QMFbrick and attempting to write a removal tool, initially focusing on the B variant.