test-for-finfisher.py

import os
import os.path

# Tests for suspicious folders used by finfisher.
# Source: 
#   http://belsec.skynetblogs.be/archive/2014/08/07/check-your-linuxservers-are-you-infected-with-the-finphisher-8252101.html

first = ['.fontconfig', '.gconf', '.gnome', '.gnome2', '.kde', '.local',
         '.qt', '.ssh']
second = ['.config', '.bin', '.sbin', '.etc', '.cfg', '.apps']

ok = True
for home in os.listdir('/home'):
    phome = os.path.join('/home', home)
    for fn in first:
        fp = os.path.join(phome, fn)
        if not os.path.exists(fp):
            continue
        for sn in second:
            sp = os.path.join(fp, sn)
            if not os.path.exists(sp):
                continue
            ok = False
            print 'Check', sp
if ok:
    print 'Everything seems fine'

# vim: sw=4:ts=4:et