MMD-0069-2024 - An old ELF Ransomware pivoted crypto (OpenSSL to PolarSSL)...
This malware analysis was originally posted in 2015 on my-soon-to-be-closed Japanese blog and to avoid the research information disappearing I re-posted it as an English translation over here. During...
View ArticleMMD-0068-2024 - "FHAPPI Campaign" (APT10) FreeHosting APT PowerSploit Poison Ivy
I am @unixfreaxjp of MalwareMustDie team. This is the English translation of APT overall analysis I made in Japanese at my Japan security blog: "#OCJP-136: 「FHAPPI」 Geocities.jpとPoison...
View ArticleMMD-067-2021 - Recent talks on shellcode analysis series at R2CON-2020,...
Tag: Linux, LinuxSecurity, Memory Fornsics, RE, ReverseEnineering, DFIR, Fileless, ProcessInjection, Shellcode, Exploit, PostExploitation, BlueTeaming, HandsOut, Demo, Video, Slides, Presentation The...
View ArticleMMD-0066-2020 - Linux/Mirai-Fbot - A re-emerged IoT threat
Chapters: [TelnetLoader] [EchoLoader] [Propagation] [NewActor] [Epilogue] Prologue A month ago I wrote about IoT malware for Linux operating system, a Mirai botnet's client variant dubbed as FBOT. The...
View ArticleMMD-0065-2020 - Linux/Mirai-Fbot's new encryption explained
Prologue [For the most recent information of this threat please follow this ==> link] I setup a local brand new ARM base router I bought online around this new year 2020 to replace my old pots, and...
View ArticleMore about my 2019.HACK.LU Keynote talk
As promised, this is my additional notes and review about my Keynote talk in 2019.HACK.LU (link). My keynote talk title is very long actually, but it explained the description of the whole slides...
View ArticleMMD-0064-2019 - Linux/AirDropBot
Prologue There are a lot of botnet aiming multiple architecture of Linux basis internet of thing, and this story is just one of them, but I haven't seen the one was coded like this before. Like the...
View ArticleMMD-0063-2019 - Summary of 3 years MMD research (Sept 2016-Sept 2019)
Hello, it's unixfreaxjp here. It has been a while since I wrote our own blog, and it is good to be back. Thank you for your patience for all of this time. If you want to see what we were doing during...
View ArticleMMD-0062-2017 - Credential harvesting by SSH Direct TCP Forward attack via...
Sticky note: We call this threat as "Strudels Attack" 1. Background In this post there is no malicious software/malware analyzed, but this is one of the impact of the malware infecting IoT devices...
View ArticleMMD-0061-2016 - EnergyMech 2.8 overkill mod
This is a new threat analysis report I wrote in MalwareMustDie blog (this) after we moved out from blogger, I hope you like the new blog system and design, and enjoy the post! An unattended or...
View ArticleMMD-0060-2016 - Linux/UDPfker and ChinaZ threat today
Background ChinaZ is the PRC (Public Rep of China) actor's made Linux ELF DDoS malware and its service. This threat has been covered several times in this blog post, several takedown efforts also had...
View ArticleMMD-0059-2016 - Linux/IRCTelnet (new Aidra) - A DDoS botnet aims IoT w/ IPv6...
It's a Kaiten/Tsunami? No.. STD?? No! It's a GayFgt/Torlus/Qbot? No!! Is it Mirai?? NO!! It's a Linux/IRCTelnet (new Aidra)! ..a new coded IoT DDoS botnet's Linux malware.. Summary This post is a...
View ArticleMMD-0058-2016 - Linux/NyaDrop - a linux MIPS IoT bad news
Background Since the end of September 2016 I received a new type of attacks that aims the MIPS platform I provided to detect IoT attacks. I will call this threat as new ELF Linux/NyaDrop as per the...
View ArticleClik here to view.
MMD-0057-2016 - New ELF botnet: Linux/LuaBot
BackgroundOn Mon, Aug 29, 2016 at 5:07 PM I received this ELF malware sample from a person (thank you!). There wasn't any detail or comment what so ever just one cute little ARM ELF stripped binary...
View ArticleClik here to view.
MMD-0056-2016 - Linux/Mirai, how an old ELF malcode is recycled..
BackgroundFrom August 4th 2016 several sysadmin friends were helping us by uploading this malware files to our dropbox. The samples of this particular ELF malware ware not easy to retrieve, there are...
View ArticleClik here to view.
MMD-0055-2016 - Linux/PnScan ; ELF worm that still circles around
BackgroundJust checked around internet and found an interesting ELF worm distribution that may help raising awareness for fellow sysadmins. As per shown in title, it's a known ELF malware threat, could...
View ArticleClik here to view.
MMD-0054-2016 - ATMOS botnet facts you should know
The backgroundThis post is about recent intelligence and sharing information of the currently emerged credential stealer and spying botnet named "Atmos", for the purpose of threat recognizing, incident...
View ArticleClik here to view.
[Slide] The Kelihos & Severa; the "All Out" version
Tag: Kelihos, Khelios, P2P, FastFlux, Botnet, CNC, C2, Clickfraud, Traffic Redirection, Spambot, DNS Poison, Botnet as Service, Affiliate, Severa, Peter Severa, Petrushakov, SaeverWarning: It's a...
View ArticleClik here to view.
MMD-0053-2016 - A bit about ELF/STD IRC Bot: x00's CBack aka xxx.pokemon(.)inc
Latest UPDATE incident of this threat is-->[link]BackgroundI received the report of the host in Google cloud network is serving ELF malware:{"ip": "130.211.127.186","hostname":...
View ArticleMMD-0052-2016 - SkidDDOS ELF infection Jan-Feb 2016
BackgroundThese are the statistic comprehensional data for the infection of the ELF malware DDOS-er which its source codes we snagged and reported in previous MalwareMustDie blog post [MMD-0044-2015]....
View Article
