MalwareMustDie
Re:4-Minutes ARM RE crash course to grab FBOT's pushed hexstring payloads
on Tuesday April 28, 2020 @11:26AM (#23007902)
The video's URL has been moved to:
https://www.youtube.com/watch?v=1cIxT09cH2k
For updating purpose. - MalwareMustDie -
4-Minutes ARM RE crash course to grab FBOT's pushed hexstring payloads
Easy 1minute tutorial to dissect any pushed hexstrings IoT malware loader URL
Let's practise binary reverse engineering during corona isolation time
I added a new chapter, a Linux binary basic reverse engineering knowhow is shared in one practical example, to motivate young folks who get isolated due to corona pandemic, to use their time to learn a cool stuff! The direct url to newly-added chapter is:https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html#echoloader
A new way of China/PRC adversaries mining our machines with bash-base64 ELF
This is how I reverse-engineered a re-emerged IoT threat
Linux/Exaramel (BlackEnergy)- Re of the Backdoor Version of a Russian ICS Threat
Linux/Mirai-Fbot's new encryption explained
HACKLU2019: Linux fileless infection, process injection and post exploitation
A Packed “Cat” in Your IoT – Packed ELF Bot Binary on Embedded Linux
Linux/AirDropBot – With reversing hands-out for ELF MIPS stripped binary on “r2”
Summarized report of three years MalwareMustDie research (Sept 2016-Sept 2019)
Raccoon stealer recent infection in the wild
Dissecting on-memory powershell post exploit beacon encoded binary by radare2
Linux/HelloBot (another ELF bot malware from China actors)
Re:Trojan ELF Go-Lang Miner-Loader by SystemTen Aim Linux via Jenkins/...
on Monday April 29, 2019 @03:21PM (#19781693)
Updated blocklist is in here: https://old.reddit.com/r/LinuxMalware/comments/bfaea2/fun_in...
Tutorial on debugging ELF .so malware executed via LD_PRELOAD
The list of Linux malware analysis posts (afer-MalwareMustDie blog)
R2CON (Reversing conference) talk about dissecting ELF custom packers
Reversing an Android RAT and rootkit that targets Honda cars IoT panels
Re:Trojan ELF Go-Lang Miner-Loader by SystemTen Aim Linux via Jenkins/...
on Tuesday April 23, 2019 @03:58AM (#19726475)
Use this info to block the attacker infrastructure to contain the threat while cleaning up:
https://old.reddit.com/r/LinuxMalware/comments/bfaea2/fun_in...
Trojan ELF Go-Lang Miner-Loader by SystemTen Aim Linux via Jenkins/Groovy RCE
Cayosin DDoS Botnet – Evolution of a Combined IoT Botnet Malcodes
Linux/DDoSMan and its C2 toolkit – How this brings old ELF trojan back to action
Re:CNN trojan top story
on Friday February 06, 2015 @11:26PM (#9013056)
is not only that page..
Re:Analysis of the Linux backdoor used in Freenode IRC network compromise
on Tuesday October 14, 2014 @11:56PM (#8457099)
Anyone know the hash, pls? Thanks.
We need to add this to ELF malware repository. It's a serious effort to raise detection of ELF malware, reference: https://www.youtube.com/watch?v=Q9RcVjCXIOU
Re:Ongoing malware attack targeting Apache hijacks 20,000 sites
on Wednesday April 03, 2013 @11:42AM (#5486779)
There is an additional good information posted in the Cisco Blog today, the comments part explains good info's:
http://blogs.cisco.com/security/apache-darkleech-compromises...