MMD-071-2026 KinsingBot a "bad-bad"-designed Linux botnet a while ago.. until recent. Part I — Malware analysis《 1. Introduction 》Read & use this knowledge with caution, this post i... 2026-11-11 17:10:40 | 阅读: 10 | 收藏 | Malware Must Die! - blog.malwaremustdie.org c2 kinsing malicious miner pasted

MMD-0070-2026 - Once upon a time, Linux/Hajime hexstring-pushed a tiny ARM ELF fileless downloader The "Hajime" botnet network 6 years ago..This post I have written and saved for quite a long time... 2026-11-11 14:21:44 | 阅读: 13 | 收藏 | Malware Must Die! - blog.malwaremustdie.org network payload packed peers 8s

MMD-069-2024 - An old ELF Ransomware pivoted crypto from OpenSSL to PolarSSL This malware analysis was originally posted in my soon to be closed Japanese blog in 2015 and to av... 2024-6-19 17:7:0 | 阅读: 31 | 收藏 | Malware Must Die! - blog.malwaremustdie.org ransomware polarssl encryption mbedtls analysis

MMD-068-2024 - English Report of "FHAPPI Campaign" : FreeHosting APT PowerSploit Poison Ivy I am @unixfreaxjp of MalwareMustDie team. This is the English translation of APT overall analysis I... 2024-6-19 00:30:0 | 阅读: 34 | 收藏 | Malware Must Die! - blog.malwaremustdie.org shellcode poison ivy powershell analysis

MMD-067-2021 - Recent talks on shellcode analysis series at R2CON-2020, ROOTCON-14 2020 from HACK.LU-2019 Tag: Linux, LinuxSecurity, Memory Fornsics, RE, ReverseEnineering, DFIR, Fileless, ProcessInjection... 2021-3-3 12:41:0 | 阅读: 10 | 收藏 | Malware Must Die! - blog.malwaremustdie.org shellcode analysis talks security rootcon

MMD-0066-2020 - Linux/Mirai-Fbot - A re-emerged IoT threat Chapters: [TelnetLoader] [EchoLoader] [Propagation] [NewActor] [Epilogue]PrologueA month ago I w... 2020-2-24 04:26:0 | 阅读: 14 | 收藏 | Malware Must Die! - blog.malwaremustdie.org fbot fcn pushed svc c2

MMD-0065-2020 - Linux/Mirai-Fbot's new encryption explained Prologue[For the most recent information of this threat please follow this ==> link]I setup a l... 2020-1-15 20:48:0 | 阅读: 20 | 收藏 | Malware Must Die! - blog.malwaremustdie.org analysis fbot encryption memory decrypted

More about my 2019.HACK.LU Keynote talk As promised, this is my additional notes and review about my Keynote talk in 2019.HACK.LU (link). M... 2019-10-28 22:2:0 | 阅读: 11 | 收藏 | Malware Must Die! - blog.malwaremustdie.org security lu radare2 analysis injection

MMD-0064-2019 - Linux/AirDropBot PrologueThere are a lot of botnet aiming multiple architecture of Linux basis internet of thing, a... 2019-9-28 01:35:0 | 阅读: 15 | 收藏 | Malware Must Die! - blog.malwaremustdie.org cloudbot bins radare2 analysis c2

MMD-0063-2019 - Summary of 3 years MMD research (Sept 2016-Sept 2019) Hello, it's unixfreaxjp here. It has been a while since I wrote our own blog, and it is good to be... 2019-9-21 20:21:0 | 阅读: 9 | 收藏 | Malware Must Die! - blog.malwaremustdie.org security chinaz analysis kaiten

MMD-0062-2017 - Credential harvesting by SSH Direct TCP Forward attack via IoT botnet Sticky note: We call this threat as "Strudels Attack"1. BackgroundIn this post there is no malici... 2017-3-7 23:50:0 | 阅读: 10 | 收藏 | Malware Must Die! - blog.malwaremustdie.org ssh attacker forwarding 0x28065e80 attackers

MMD-0061-2016 - EnergyMech 2.8 overkill mod This is a new threat analysis report I wrote in MalwareMustDie blog (this) after we moved out fr... 2016-12-3 06:11:0 | 阅读: 10 | 收藏 | Malware Must Die! - blog.malwaremustdie.org energymech shellcmd stripped sysv 80386

MMD-0060-2016 - Linux/UDPfker and ChinaZ threat today BackgroundChinaZ is the PRC (Public Rep of China) actor's made Linux ELF DDoS malware and its ser... 2016-10-30 22:21:0 | 阅读: 12 | 收藏 | Malware Must Die! - blog.malwaremustdie.org 55678 chinaz udpfker s58595 10991fuck

MMD-0059-2016 - Linux/IRCTelnet (new Aidra) - A DDoS botnet aims IoT w/ IPv6 ready It's a Kaiten/Tsunami? No.. STD?? No! It's a GayFgt/Torlus/Qbot? No!! Is it Mirai?? NO!!It's a Lin... 2016-10-29 00:47:0 | 阅读: 20 | 收藏 | Malware Must Die! - blog.malwaremustdie.org aidra coded irc irctelnet malicious

MMD-0058-2016 - Linux/NyaDrop - a linux MIPS IoT bad news Background Since the end of September 2016 I received a new type of attacks that aims the MIPS pl... 2016-10-14 04:2:0 | 阅读: 14 | 收藏 | Malware Must Die! - blog.malwaremustdie.org nyadrop socketcall svc mr nya

MMD-0057-2016 - Linux/LuaBot - IoT botnet as service BackgroundOn Mon, Aug 29, 2016 at 5:07 PM I received this ELF malware sample from a person (thank... 2016-9-6 00:15:0 | 阅读: 14 | 收藏 | Malware Must Die! - blog.malwaremustdie.org lua luabot reclen ino coder

MMD-0056-2016 - Linux/Mirai, how an old ELF malcode is recycled.. Our recent analysis about Mirai is in here==>[Link]BackgroundFrom August 4th 2016 several sysad... 2016-9-1 10:34:0 | 阅读: 15 | 收藏 | Malware Must Die! - blog.malwaremustdie.org skeleton busybox 0x0000f9e8 reversing stripped

MMD-0055-2016 - Linux/PnScan ; ELF worm that still circles around BackgroundJust checked around internet and found an interesting ELF worm distribution that may he... 2016-8-24 00:9:0 | 阅读: 15 | 收藏 | Malware Must Die! - blog.malwaremustdie.org 2712 worm 0t0 network i686

MMD-0054-2016 - ATMOS botnet facts you should know The backgroundThis post is about recent intelligence and sharing information of the currently eme... 2016-6-7 19:30:0 | 阅读: 12 | 收藏 | Malware Must Die! - blog.malwaremustdie.org atmos xylit0l client facts crime

[Slide|Video] Kelihos & Peter Severa; the "All Out" version Tag: Kelihos, Khelios, P2P, FastFlux, Botnet, CNC, C2, Clickfraud, Traffic Redirection, Spambot, DN... 2016-5-9 01:33:0 | 阅读: 13 | 收藏 | Malware Must Die! - blog.malwaremustdie.org kelihos severa petrushakov crime