Why Should You Build Your Own Malware Scanner?
If you’ve ever seen your Linux server suddenly “gasping for air” with CPU usage hitting 100% due to strange processes like kinsing or xmrig, you know the feeling of helplessness when hunting for malware manually. Today’s crypto-mining scripts or web shells are cleverly disguised within directories like /tmp or /var/www/html.
Many choose ClamAV, but this tool often consumes 800MB to over 1GB of RAM just to start—a luxury many low-spec VPS instances cannot afford. This is where YARA shines. Instead of relying Hegarty signature-based scanning, YARA allows you to define flexible rules to identify malware through characteristic patterns. It’s like giving a detective a detailed description instead of forcing them to memorize a list of millions of criminals.
By combining Python with yara-python, we can create a complete automation system. You can perform periodic scans, filter files by size, and send instant alerts to Telegram with just a few dozen lines of code.
Setting Up the Environment
To get started, your server needs Python 3. The installation process is quick, taking less than 2 minutes on Ubuntu or Debian-based systems.
1. Installing Libraries
# Update package list
sudo apt update
# Install build tools and Python headers
sudo apt install -y build-essential python3-dev
# Install YARA library for Python
pip install yara-python2. Defining Scanning Rules (YARA Rules)
The power of a scanner lies in its rule set. Instead of writing them from scratch, you can leverage massive community-driven rule repositories on GitHub. However, to start, let’s create a simple file named webshell_rules.yar to capture dangerous PHP functions:
rule Detect_Webshell_PHP {
strings:
$a = "eval(base64_decode"
$b = "shell_exec"
$c = "system($_GET"
condition:
any of them
}Writing the Malware Scanner Script with Python
We need a script smart enough to traverse directories without crashing the server due to permission issues or scanning massive junk files.
Core Processing Logic
In practice, scanning the entire hard drive is unnecessary. I usually limit files to under 10MB to optimize speed. A good scanning script should gracefully handle PermissionError when encountering sensitive system files.
import yara
import os
import logging
# Log for later reference
logging.basicConfig(
level=logging.INFO,
format='%(asctime)s - %(levelname)s - %(message)s',
filename='scanner.log'
)
def compile_rules(rule_path):
try:
return yara.compile(filepath=rule_path)
except yara.Error as e:
print(f"Rule compilation error: {e}")
return None
def scan_directory(path, rules):
print(f"[*] Scanning: {path}")
for root, _, files in os.walk(path):
for file in files:
file_path = os.path.join(root, file)
try:
# Only scan files smaller than 10MB to save resources
if os.path.getsize(file_path) > 10 * 1024 * 1024:
continue
matches = rules.match(file_path)
if matches:
msg = f"[!] Suspicious file detected: {file_path} (Rule: {matches})"
print(msg)
logging.warning(msg)
except (PermissionError, OSError):
continue
if __name__ == "__main__":
rules = compile_rules('webshell_rules.yar')
if rules:
# Focus on sensitive areas
scan_directory('/var/www/html', rules)
print("--- Scan completed ---")Optimization Tips with Regex
Modern malware often uses code obfuscation. Therefore, you should use Regex in YARA rules to catch complex variants. Never be overconfident with the Regex you’ve just written. I often use the regex tester at toolcraft.app for a quick pattern check. This tool runs right in your browser, helping you accurately determine if a pattern matches actual shell code samples before loading them into your system.
Automation and Monitoring
Running scripts manually is time-consuming. Let the server handle it in the middle of the night.
1. Scheduling Scans with Cron
2:00 AM is usually when traffic is lowest, making it the ideal time for malware scans. Add the following line to crontab -e:
0 2 * * * /usr/bin/python3 /root/scripts/scanner.py2. Getting Instant Alerts via Telegram
Instead of straining your eyes reading logs, let the script send a message to your phone when an event occurs. You just need to add a few lines of code using the requests library:
import requests
def alert_telegram(message):
token = "YOUR_BOT_TOKEN"
chat_id = "YOUR_CHAT_ID"
payload = {"chat_id": chat_id, "text": message}
requests.post(f"https://api.telegram.org/bot{token}/sendMessage", data=payload)3. Performance Considerations
If your server is running critical services, use the nice or ionice command when running the script. For example: nice -n 19 python3 scanner.py. This ensures the operating system prioritizes resources for the web server or database first, preventing the scanner from disrupting user services.
Building your own Malware Scanner not only saves costs but is also a great way to deepen your understanding of Linux security. Start with simple rule sets and gradually upgrade them based on your actual needs!
