[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADP2XBN80RP6SXWWESWDBN":3,"skill-same:01M6ADP2XBN80RP6SXWWESWDBN":127},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":45,"linkOnly":46,"markdownContent":47,"markdownBody":48,"frontMatter":49,"refName":86,"commitSha":87,"skillDirectory":88,"forksCount":89,"repositoryHtmlUrl":90,"repositoryHomepageUrl":91,"ownerHtmlUrl":92,"ownerBlogUrl":93,"ownerDescription":94,"updatedAt":95,"install":96,"resources":109},"01M6ADP2XBN80RP6SXWWESWDBN","analyzing-linux-elf-malware",null,"Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure — through static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM samples. Use when investigating Linux malware, triaging a suspicious ELF binary, assessing a compromised Linux server, or analyzing container-targeted malware.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-linux-elf-malware\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44],"analyzing linux elf malware","linux","malware","server","server-malware","ELF","malware-analysis","reverse-engineering","engineering","cloud","malicious","transfer","tracing","infrastructure","cybersecurity","static analysis","containers","suspicious","2026-11-10 10:12:30",false,"---\nname: analyzing-linux-elf-malware\ndescription: 'Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware,\n  and rootkits targeting Linux servers, containers, and cloud infrastructure — through\n  static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM samples.\n  Use when investigating Linux malware, triaging a suspicious ELF binary, assessing\n  a compromised Linux server, or analyzing container-targeted malware.\n\n  '\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- malware\n- Linux\n- ELF\n- reverse-engineering\n- server-malware\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1027\n- T1059.004\n- T1620\n- T1574.006\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - positioning\n  - monetization\n  - reconnaissance\n  techniques:\n  - id: T1219\n    name: Remote Access Tools\n    tactic: positioning\n    source: attack\n  - id: T1555\n    name: Credentials from Password Stores\n    tactic: reconnaissance\n    source: attack\n  - id: F1018\n    name: Convert to Cryptocurrency\n    tactic: monetization\n    source: f3\n  - id: F1047\n    name: Transfer of funds\n    tactic: monetization\n    source: f3\n---\n\n# Analyzing Linux ELF Malware\n\n## When to Use\n\n- A Linux server or container has been compromised and suspicious ELF binaries are found\n- Analyzing Linux botnets (Mirai, Gafgyt, XorDDoS), cryptominers, or ransomware\n- Investigating malware targeting cloud infrastructure, Docker containers, or Kubernetes pods\n- Reverse engineering Linux rootkits and kernel modules\n- Analyzing cross-platform malware compiled for Linux x86_64, ARM, or MIPS architectures\n\n**Do not use** for Windows PE binary analysis; use PEStudio, Ghidra, or IDA for Windows malware.\n\n## Prerequisites\n\n- Ghidra or IDA with Linux ELF support for disassembly and decompilation\n- Linux analysis VM (Ubuntu 22.04 recommended) with development tools installed\n- strace, ltrace, and GDB for dynamic analysis and debugging\n- readelf, objdump, and nm from GNU binutils for static inspection\n- Radare2 for quick binary triage and scripted analysis\n- Docker for isolated container-based malware execution\n\n## Workflow\n\n### Step 1: Identify ELF Binary Properties\n\nExamine the ELF header and basic properties:\n\n```bash\n# File type identification\nfile suspect_binary\n\n# Detailed ELF header analysis\nreadelf -h suspect_binary\n\n# Section headers\nreadelf -S suspect_binary\n\n# Program headers (segments)\nreadelf -l suspect_binary\n\n# Symbol table (if not stripped)\nreadelf -s suspect_binary\nnm suspect_binary 2>\u002Fdev\u002Fnull\n\n# Dynamic linking information\nreadelf -d suspect_binary\nldd suspect_binary 2>\u002Fdev\u002Fnull  # Only on matching architecture!\n\n# Compute hashes\nmd5sum suspect_binary\nsha256sum suspect_binary\n\n# Check for packing\u002FUPX\nupx -t suspect_binary\n```\n\n```python\n# Python-based ELF analysis\nfrom elftools.elf.elffile import ELFFile\nimport hashlib\n\nwith open(\"suspect_binary\", \"rb\") as f:\n    data = f.read()\n    sha256 = hashlib.sha256(data).hexdigest()\n\nwith open(\"suspect_binary\", \"rb\") as f:\n    elf = ELFFile(f)\n\n    print(f\"SHA-256:      {sha256}\")\n    print(f\"Class:        {elf.elfclass}-bit\")\n    print(f\"Endian:       {elf.little_endian and 'Little' or 'Big'}\")\n    print(f\"Machine:      {elf.header.e_machine}\")\n    print(f\"Type:         {elf.header.e_type}\")\n    print(f\"Entry Point:  0x{elf.header.e_entry:X}\")\n\n    # Check if stripped\n    symtab = elf.get_section_by_name('.symtab')\n    print(f\"Stripped:     {'Yes' if symtab is None else 'No'}\")\n\n    # Section entropy analysis\n    import math\n    from collections import Counter\n    for section in elf.iter_sections():\n        data = section.data()\n        if len(data) > 0:\n            entropy = -sum((c\u002Flen(data)) * math.log2(c\u002Flen(data))\n                          for c in Counter(data).values() if c > 0)\n            if entropy > 7.0:\n                print(f\"  [!] High entropy section: {section.name} ({entropy:.2f})\")\n```\n\n### Step 2: Extract Strings and Indicators\n\nSearch for embedded IOCs and functionality clues:\n\n```bash\n# ASCII strings\nstrings suspect_binary > strings_output.txt\n\n# Search for network indicators\ngrep -iE \"(http|https|ftp):\u002F\u002F\" strings_output.txt\ngrep -iE \"([0-9]{1,3}\\.){3}[0-9]{1,3}\" strings_output.txt\ngrep -iE \"[a-zA-Z0-9.-]+\\.(com|net|org|io|ru|cn)\" strings_output.txt\n\n# Search for shell commands\ngrep -iE \"(bash|sh|wget|curl|chmod|\u002Ftmp\u002F|\u002Fdev\u002F)\" strings_output.txt\n\n# Search for crypto mining indicators\ngrep -iE \"(stratum|xmr|monero|pool\\.|mining)\" strings_output.txt\n\n# Search for SSH\u002Fcredential theft\ngrep -iE \"(ssh|authorized_keys|id_rsa|shadow|passwd)\" strings_output.txt\n\n# Search for persistence mechanisms\ngrep -iE \"(crontab|systemd|init\\.d|rc\\.local|ld\\.so\\.preload)\" strings_output.txt\n\n# FLOSS for obfuscated strings (if available)\nfloss suspect_binary\n```\n\n### Step 3: Analyze System Calls and Library Usage\n\nIdentify what system calls and libraries the malware uses:\n\n```bash\n# List imported functions (dynamically linked)\nreadelf -r suspect_binary | grep -E \"socket|connect|exec|fork|open|write|bind|listen\"\n\n# Trace system calls during execution (in isolated VM only)\nstrace -f -e trace=network,process,file -o strace_output.txt .\u002Fsuspect_binary\n\n# Trace library calls\nltrace -f -o ltrace_output.txt .\u002Fsuspect_binary\n\n# Key system calls to watch:\n# Network: socket, connect, bind, listen, accept, sendto, recvfrom\n# Process: fork, execve, clone, kill, ptrace\n# File:    open, read, write, unlink, rename, chmod\n# Persistence: inotify_add_watch (file monitoring)\n```\n\n### Step 4: Dynamic Analysis with GDB\n\nDebug the malware to observe runtime behavior:\n\n```bash\n# Start GDB with the binary\ngdb .\u002Fsuspect_binary\n\n# Set breakpoints on key functions\n(gdb) break main\n(gdb) break socket\n(gdb) break connect\n(gdb) break execve\n(gdb) break fork\n\n# Run and analyze\n(gdb) run\n(gdb) info registers    # View register state\n(gdb) x\u002F20s $rdi        # Examine string argument\n(gdb) bt                # Backtrace\n(gdb) continue\n\n# For stripped binaries, break on entry point\n(gdb) break *0x400580   # Entry point from readelf\n(gdb) run\n\n# Monitor network connections during execution\n# In another terminal:\nss -tlnp  # List listening sockets\nss -tnp   # List established connections\n```\n\n### Step 5: Reverse Engineer with Ghidra\n\nPerform deep code analysis on the ELF binary:\n\n```\nGhidra Analysis for Linux ELF:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n1. Import: File -> Import -> Select ELF binary\n   - Ghidra auto-detects ELF format and architecture\n   - Accept default analysis options\n\n2. Key analysis targets:\n   - main() function (or entry point if stripped)\n   - Socket creation and connection functions\n   - Command dispatch logic (switch\u002Fcase on received data)\n   - Encryption\u002Fencoding routines\n   - Persistence installation code\n   - Self-propagation\u002Fscanning functions\n\n3. For Mirai-like botnets, look for:\n   - Credential list for brute-forcing (telnet\u002FSSH)\n   - Attack module selection (UDP flood, SYN flood, ACK flood)\n   - Scanner module (port scanning for vulnerable devices)\n   - Killer module (killing competing botnets)\n\n4. For cryptominers, look for:\n   - Mining pool connection (stratum protocol)\n   - Wallet address strings\n   - CPU\u002FGPU utilization functions\n   - Process hiding techniques\n```\n\n### Step 6: Analyze Linux-Specific Persistence\n\nCheck for persistence mechanisms:\n\n```bash\n# Check for LD_PRELOAD rootkit\nstrings suspect_binary | grep \"ld.so.preload\"\n# Malware writing to \u002Fetc\u002Fld.so.preload can hook all dynamic library calls\n\n# Check for crontab persistence\nstrings suspect_binary | grep -i \"cron\"\n\n# Check for systemd service creation\nstrings suspect_binary | grep -iE \"systemd|\\.service|systemctl\"\n\n# Check for init script creation\nstrings suspect_binary | grep -iE \"init\\.d|rc\\.local|update-rc\"\n\n# Check for SSH key injection\nstrings suspect_binary | grep -i \"authorized_keys\"\n\n# Check for kernel module (rootkit) loading\nstrings suspect_binary | grep -iE \"insmod|modprobe|init_module\"\n\n# Check for process hiding\nstrings suspect_binary | grep -iE \"proc|readdir|getdents\"\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **ELF (Executable and Linkable Format)** | Standard binary format for Linux executables, shared libraries, and core dumps containing headers, sections, and segments |\n| **Stripped Binary** | ELF binary with debug symbols removed, making reverse engineering more difficult as function names are lost |\n| **LD_PRELOAD** | Linux environment variable specifying shared libraries to load before all others; abused by rootkits to intercept system library calls |\n| **strace** | Linux system call tracer that logs all system calls and signals made by a process, revealing file, network, and process operations |\n| **GOT\u002FPLT** | Global Offset Table and Procedure Linkage Table; ELF structures for dynamic linking that can be hijacked for function hooking |\n| **Statically Linked** | Binary compiled with all library code included; common in IoT malware to run on systems without matching shared libraries |\n| **Mirai** | Prolific Linux botnet targeting IoT devices via telnet brute-force; source code leaked, leading to many variants |\n\n## Tools & Systems\n\n- **Ghidra**: NSA reverse engineering tool with full ELF support for x86, x86_64, ARM, MIPS, and other Linux architectures\n- **Radare2**: Open-source reverse engineering framework with command-line interface for quick binary analysis and scripting\n- **strace**: Linux system call tracing tool for observing binary behavior including file, network, and process operations\n- **GDB**: GNU Debugger for setting breakpoints, examining memory, and stepping through Linux binary execution\n- **pyelftools**: Python library for parsing ELF files programmatically for automated analysis pipelines\n\n## Common Scenarios\n\n### Scenario: Analyzing a Cryptominer Found on a Compromised Linux Server\n\n**Context**: A cloud server shows 100% CPU usage. Investigation reveals an unknown binary running from \u002Ftmp with a suspicious name. The binary needs analysis to confirm it is a cryptominer and identify the attacker's wallet and pool.\n\n**Approach**:\n1. Copy the binary to an analysis VM and compute SHA-256 hash\n2. Run `file` and `readelf` to identify architecture and linking type\n3. Extract strings and search for mining pool addresses (stratum+tcp:\u002F\u002F) and wallet addresses\n4. Run with strace in a sandbox to observe network connections (mining pool connection)\n5. Import into Ghidra to identify the mining algorithm and configuration extraction\n6. Check for persistence mechanisms (crontab, systemd service, SSH keys)\n7. Document all IOCs including pool address, wallet, C2 for updates, and persistence artifacts\n\n**Pitfalls**:\n- Running `ldd` on malware outside a sandbox (ldd can execute code in the binary)\n- Not checking for ARM\u002FMIPS architecture before attempting x86_64 execution\n- Missing companion scripts (.sh files) that may handle persistence and cleanup\n- Ignoring the initial access vector (how the miner was deployed: SSH brute force, web exploit, container escape)\n\n## Output Format\n\n```\nLINUX ELF MALWARE ANALYSIS REPORT\n====================================\nFile:             \u002Ftmp\u002F.X11-unix\u002F.rsync\nSHA-256:          e3b0c44298fc1c149afbf4c8996fb924...\nType:             ELF 64-bit LSB executable, x86-64\nLinking:          Statically linked (all libraries embedded)\nStripped:         Yes\nSize:             2,847,232 bytes\nPacker:           UPX 3.96 (unpacked for analysis)\n\nCLASSIFICATION\nFamily:           XMRig Cryptominer (modified)\nVariant:          Custom build with C2 update mechanism\n\nFUNCTIONALITY\n[*] XMR (Monero) mining via RandomX algorithm\n[*] Stratum pool connection for work submission\n[*] C2 check-in for configuration updates\n[*] Process name masquerading (argv[0] = \"[kworker\u002F0:0]\")\n[*] Competitor process killing (kills other miners)\n[*] SSH key injection for re-access\n\nNETWORK INDICATORS\nMining Pool:      stratum+tcp:\u002F\u002Fpool.minexmr[.]com:4444\nC2 Server:        hxxp:\u002F\u002Fupdate.malicious[.]com\u002Fconfig\nWallet:           49jZ5Q3b...Monero_Wallet_Address...\n\nPERSISTENCE\n[1] Crontab entry: *\u002F5 * * * * \u002Ftmp\u002F.X11-unix\u002F.rsync\n[2] SSH key added to \u002Froot\u002F.ssh\u002Fauthorized_keys\n[3] Systemd service: \u002Fetc\u002Fsystemd\u002Fsystem\u002Frsync-daemon.service\n[4] Modified \u002Fetc\u002Fld.so.preload for process hiding\n\nPROCESS HIDING\nLD_PRELOAD:       \u002Fusr\u002Flib\u002F.libsystem.so\nHook:             readdir() to hide \u002Ftmp\u002F.X11-unix\u002F.rsync from ls\nHook:             fopen() to hide from \u002Fproc\u002F*\u002Fmaps reading\n```\n","# Analyzing Linux ELF Malware\n\n## When to Use\n\n- A Linux server or container has been compromised and suspicious ELF binaries are found\n- Analyzing Linux botnets (Mirai, Gafgyt, XorDDoS), cryptominers, or ransomware\n- Investigating malware targeting cloud infrastructure, Docker containers, or Kubernetes pods\n- Reverse engineering Linux rootkits and kernel modules\n- Analyzing cross-platform malware compiled for Linux x86_64, ARM, or MIPS architectures\n\n**Do not use** for Windows PE binary analysis; use PEStudio, Ghidra, or IDA for Windows malware.\n\n## Prerequisites\n\n- Ghidra or IDA with Linux ELF support for disassembly and decompilation\n- Linux analysis VM (Ubuntu 22.04 recommended) with development tools installed\n- strace, ltrace, and GDB for dynamic analysis and debugging\n- readelf, objdump, and nm from GNU binutils for static inspection\n- Radare2 for quick binary triage and scripted analysis\n- Docker for isolated container-based malware execution\n\n## Workflow\n\n### Step 1: Identify ELF Binary Properties\n\nExamine the ELF header and basic properties:\n\n```bash\n# File type identification\nfile suspect_binary\n\n# Detailed ELF header analysis\nreadelf -h suspect_binary\n\n# Section headers\nreadelf -S suspect_binary\n\n# Program headers (segments)\nreadelf -l suspect_binary\n\n# Symbol table (if not stripped)\nreadelf -s suspect_binary\nnm suspect_binary 2>\u002Fdev\u002Fnull\n\n# Dynamic linking information\nreadelf -d suspect_binary\nldd suspect_binary 2>\u002Fdev\u002Fnull  # Only on matching architecture!\n\n# Compute hashes\nmd5sum suspect_binary\nsha256sum suspect_binary\n\n# Check for packing\u002FUPX\nupx -t suspect_binary\n```\n\n```python\n# Python-based ELF analysis\nfrom elftools.elf.elffile import ELFFile\nimport hashlib\n\nwith open(\"suspect_binary\", \"rb\") as f:\n    data = f.read()\n    sha256 = hashlib.sha256(data).hexdigest()\n\nwith open(\"suspect_binary\", \"rb\") as f:\n    elf = ELFFile(f)\n\n    print(f\"SHA-256:      {sha256}\")\n    print(f\"Class:        {elf.elfclass}-bit\")\n    print(f\"Endian:       {elf.little_endian and 'Little' or 'Big'}\")\n    print(f\"Machine:      {elf.header.e_machine}\")\n    print(f\"Type:         {elf.header.e_type}\")\n    print(f\"Entry Point:  0x{elf.header.e_entry:X}\")\n\n    # Check if stripped\n    symtab = elf.get_section_by_name('.symtab')\n    print(f\"Stripped:     {'Yes' if symtab is None else 'No'}\")\n\n    # Section entropy analysis\n    import math\n    from collections import Counter\n    for section in elf.iter_sections():\n        data = section.data()\n        if len(data) > 0:\n            entropy = -sum((c\u002Flen(data)) * math.log2(c\u002Flen(data))\n                          for c in Counter(data).values() if c > 0)\n            if entropy > 7.0:\n                print(f\"  [!] High entropy section: {section.name} ({entropy:.2f})\")\n```\n\n### Step 2: Extract Strings and Indicators\n\nSearch for embedded IOCs and functionality clues:\n\n```bash\n# ASCII strings\nstrings suspect_binary > strings_output.txt\n\n# Search for network indicators\ngrep -iE \"(http|https|ftp):\u002F\u002F\" strings_output.txt\ngrep -iE \"([0-9]{1,3}\\.){3}[0-9]{1,3}\" strings_output.txt\ngrep -iE \"[a-zA-Z0-9.-]+\\.(com|net|org|io|ru|cn)\" strings_output.txt\n\n# Search for shell commands\ngrep -iE \"(bash|sh|wget|curl|chmod|\u002Ftmp\u002F|\u002Fdev\u002F)\" strings_output.txt\n\n# Search for crypto mining indicators\ngrep -iE \"(stratum|xmr|monero|pool\\.|mining)\" strings_output.txt\n\n# Search for SSH\u002Fcredential theft\ngrep -iE \"(ssh|authorized_keys|id_rsa|shadow|passwd)\" strings_output.txt\n\n# Search for persistence mechanisms\ngrep -iE \"(crontab|systemd|init\\.d|rc\\.local|ld\\.so\\.preload)\" strings_output.txt\n\n# FLOSS for obfuscated strings (if available)\nfloss suspect_binary\n```\n\n### Step 3: Analyze System Calls and Library Usage\n\nIdentify what system calls and libraries the malware uses:\n\n```bash\n# List imported functions (dynamically linked)\nreadelf -r suspect_binary | grep -E \"socket|connect|exec|fork|open|write|bind|listen\"\n\n# Trace system calls during execution (in isolated VM only)\nstrace -f -e trace=network,process,file -o strace_output.txt .\u002Fsuspect_binary\n\n# Trace library calls\nltrace -f -o ltrace_output.txt .\u002Fsuspect_binary\n\n# Key system calls to watch:\n# Network: socket, connect, bind, listen, accept, sendto, recvfrom\n# Process: fork, execve, clone, kill, ptrace\n# File:    open, read, write, unlink, rename, chmod\n# Persistence: inotify_add_watch (file monitoring)\n```\n\n### Step 4: Dynamic Analysis with GDB\n\nDebug the malware to observe runtime behavior:\n\n```bash\n# Start GDB with the binary\ngdb .\u002Fsuspect_binary\n\n# Set breakpoints on key functions\n(gdb) break main\n(gdb) break socket\n(gdb) break connect\n(gdb) break execve\n(gdb) break fork\n\n# Run and analyze\n(gdb) run\n(gdb) info registers    # View register state\n(gdb) x\u002F20s $rdi        # Examine string argument\n(gdb) bt                # Backtrace\n(gdb) continue\n\n# For stripped binaries, break on entry point\n(gdb) break *0x400580   # Entry point from readelf\n(gdb) run\n\n# Monitor network connections during execution\n# In another terminal:\nss -tlnp  # List listening sockets\nss -tnp   # List established connections\n```\n\n### Step 5: Reverse Engineer with Ghidra\n\nPerform deep code analysis on the ELF binary:\n\n```\nGhidra Analysis for Linux ELF:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n1. Import: File -> Import -> Select ELF binary\n   - Ghidra auto-detects ELF format and architecture\n   - Accept default analysis options\n\n2. Key analysis targets:\n   - main() function (or entry point if stripped)\n   - Socket creation and connection functions\n   - Command dispatch logic (switch\u002Fcase on received data)\n   - Encryption\u002Fencoding routines\n   - Persistence installation code\n   - Self-propagation\u002Fscanning functions\n\n3. For Mirai-like botnets, look for:\n   - Credential list for brute-forcing (telnet\u002FSSH)\n   - Attack module selection (UDP flood, SYN flood, ACK flood)\n   - Scanner module (port scanning for vulnerable devices)\n   - Killer module (killing competing botnets)\n\n4. For cryptominers, look for:\n   - Mining pool connection (stratum protocol)\n   - Wallet address strings\n   - CPU\u002FGPU utilization functions\n   - Process hiding techniques\n```\n\n### Step 6: Analyze Linux-Specific Persistence\n\nCheck for persistence mechanisms:\n\n```bash\n# Check for LD_PRELOAD rootkit\nstrings suspect_binary | grep \"ld.so.preload\"\n# Malware writing to \u002Fetc\u002Fld.so.preload can hook all dynamic library calls\n\n# Check for crontab persistence\nstrings suspect_binary | grep -i \"cron\"\n\n# Check for systemd service creation\nstrings suspect_binary | grep -iE \"systemd|\\.service|systemctl\"\n\n# Check for init script creation\nstrings suspect_binary | grep -iE \"init\\.d|rc\\.local|update-rc\"\n\n# Check for SSH key injection\nstrings suspect_binary | grep -i \"authorized_keys\"\n\n# Check for kernel module (rootkit) loading\nstrings suspect_binary | grep -iE \"insmod|modprobe|init_module\"\n\n# Check for process hiding\nstrings suspect_binary | grep -iE \"proc|readdir|getdents\"\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **ELF (Executable and Linkable Format)** | Standard binary format for Linux executables, shared libraries, and core dumps containing headers, sections, and segments |\n| **Stripped Binary** | ELF binary with debug symbols removed, making reverse engineering more difficult as function names are lost |\n| **LD_PRELOAD** | Linux environment variable specifying shared libraries to load before all others; abused by rootkits to intercept system library calls |\n| **strace** | Linux system call tracer that logs all system calls and signals made by a process, revealing file, network, and process operations |\n| **GOT\u002FPLT** | Global Offset Table and Procedure Linkage Table; ELF structures for dynamic linking that can be hijacked for function hooking |\n| **Statically Linked** | Binary compiled with all library code included; common in IoT malware to run on systems without matching shared libraries |\n| **Mirai** | Prolific Linux botnet targeting IoT devices via telnet brute-force; source code leaked, leading to many variants |\n\n## Tools & Systems\n\n- **Ghidra**: NSA reverse engineering tool with full ELF support for x86, x86_64, ARM, MIPS, and other Linux architectures\n- **Radare2**: Open-source reverse engineering framework with command-line interface for quick binary analysis and scripting\n- **strace**: Linux system call tracing tool for observing binary behavior including file, network, and process operations\n- **GDB**: GNU Debugger for setting breakpoints, examining memory, and stepping through Linux binary execution\n- **pyelftools**: Python library for parsing ELF files programmatically for automated analysis pipelines\n\n## Common Scenarios\n\n### Scenario: Analyzing a Cryptominer Found on a Compromised Linux Server\n\n**Context**: A cloud server shows 100% CPU usage. Investigation reveals an unknown binary running from \u002Ftmp with a suspicious name. The binary needs analysis to confirm it is a cryptominer and identify the attacker's wallet and pool.\n\n**Approach**:\n1. Copy the binary to an analysis VM and compute SHA-256 hash\n2. Run `file` and `readelf` to identify architecture and linking type\n3. Extract strings and search for mining pool addresses (stratum+tcp:\u002F\u002F) and wallet addresses\n4. Run with strace in a sandbox to observe network connections (mining pool connection)\n5. Import into Ghidra to identify the mining algorithm and configuration extraction\n6. Check for persistence mechanisms (crontab, systemd service, SSH keys)\n7. Document all IOCs including pool address, wallet, C2 for updates, and persistence artifacts\n\n**Pitfalls**:\n- Running `ldd` on malware outside a sandbox (ldd can execute code in the binary)\n- Not checking for ARM\u002FMIPS architecture before attempting x86_64 execution\n- Missing companion scripts (.sh files) that may handle persistence and cleanup\n- Ignoring the initial access vector (how the miner was deployed: SSH brute force, web exploit, container escape)\n\n## Output Format\n\n```\nLINUX ELF MALWARE ANALYSIS REPORT\n====================================\nFile:             \u002Ftmp\u002F.X11-unix\u002F.rsync\nSHA-256:          e3b0c44298fc1c149afbf4c8996fb924...\nType:             ELF 64-bit LSB executable, x86-64\nLinking:          Statically linked (all libraries embedded)\nStripped:         Yes\nSize:             2,847,232 bytes\nPacker:           UPX 3.96 (unpacked for analysis)\n\nCLASSIFICATION\nFamily:           XMRig Cryptominer (modified)\nVariant:          Custom build with C2 update mechanism\n\nFUNCTIONALITY\n[*] XMR (Monero) mining via RandomX algorithm\n[*] Stratum pool connection for work submission\n[*] C2 check-in for configuration updates\n[*] Process name masquerading (argv[0] = \"[kworker\u002F0:0]\")\n[*] Competitor process killing (kills other miners)\n[*] SSH key injection for re-access\n\nNETWORK INDICATORS\nMining Pool:      stratum+tcp:\u002F\u002Fpool.minexmr[.]com:4444\nC2 Server:        hxxp:\u002F\u002Fupdate.malicious[.]com\u002Fconfig\nWallet:           49jZ5Q3b...Monero_Wallet_Address...\n\nPERSISTENCE\n[1] Crontab entry: *\u002F5 * * * * \u002Ftmp\u002F.X11-unix\u002F.rsync\n[2] SSH key added to \u002Froot\u002F.ssh\u002Fauthorized_keys\n[3] Systemd service: \u002Fetc\u002Fsystemd\u002Fsystem\u002Frsync-daemon.service\n[4] Modified \u002Fetc\u002Fld.so.preload for process hiding\n\nPROCESS HIDING\nLD_PRELOAD:       \u002Fusr\u002Flib\u002F.libsystem.so\nHook:             readdir() to hide \u002Ftmp\u002F.X11-unix\u002F.rsync from ls\nHook:             fopen() to hide from \u002Fproc\u002F*\u002Fmaps reading\n```\n",{"name":5,"tags":50,"author":52,"domain":41,"license":15,"version":53,"mitre_f3":54,"nist_csf":75,"subdomain":33,"description":80,"mitre_attack":81},[29,51,32,34,31],"Linux","mahipal","1.0.0",{"tactics":55,"version":59,"techniques":60},[56,57,58],"positioning","monetization","reconnaissance","1.1",[61,65,68,72],{"id":62,"name":63,"source":64,"tactic":56},"T1219","Remote Access Tools","attack",{"id":66,"name":67,"source":64,"tactic":58},"T1555","Credentials from Password Stores",{"id":69,"name":70,"source":71,"tactic":57},"F1018","Convert to Cryptocurrency","f3",{"id":73,"name":74,"source":71,"tactic":57},"F1047","Transfer of funds",[76,77,78,79],"DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01","Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure — through static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM samples. Use when investigating Linux malware, triaging a suspicious ELF binary, assessing a compromised Linux server, or analyzing container-targeted malware.\n",[82,83,84,85],"T1027","T1059.004","T1620","T1574.006","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fanalyzing-linux-elf-malware",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":97,"prompt":107,"zipAvailable":108},[98,101,104],{"tool":99,"command":100},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-linux-elf-malware",{"tool":102,"command":103},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-linux-elf-malware",{"tool":105,"command":106},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-linux-elf-malware","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-linux-elf-malware\u002FSKILL.md",true,[110,115,121],{"path":111,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":113,"sourceHtmlUrl":114},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-linux-elf-malware\u002FLICENSE",{"path":116,"resourceType":117,"resourceTypeDesc":118,"sizeBytes":119,"sourceHtmlUrl":120},"references\u002Fapi-reference.md","REFERENCE","参考文档",3126,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-linux-elf-malware\u002Freferences\u002Fapi-reference.md",{"path":122,"resourceType":123,"resourceTypeDesc":124,"sizeBytes":125,"sourceHtmlUrl":126},"scripts\u002Fagent.py","SCRIPT","脚本",8794,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-linux-elf-malware\u002Fscripts\u002Fagent.py",[128,155,179,206,232,259],{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":135,"publishedAt":45},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[134],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[136,137,138,139,140,41,141,142,143,144,145,146,147,148,149,150,151,152,153,154],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":162,"publishedAt":45},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[161],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[163,151,164,165,140,166,41,143,167,168,169,170,171,172,173,174,175,176,177,178],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":189,"publishedAt":45},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[185,188],{"categoryNo":186,"categoryName":187,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[173,190,191,192,193,41,40,194,167,195,196,197,198,199,200,201,202,203,204,205],"backup","recovery","validating backup integrity for recovery","testing","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":207,"name":208,"nameZh":6,"description":209,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":210,"categories":211,"keywords":213,"publishedAt":45},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[212],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[214,215,216,41,217,218,219,220,221,222,223,224,225,226,227,228,170,229,230,231],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":233,"name":234,"nameZh":6,"description":235,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":236,"categories":237,"keywords":239,"publishedAt":45},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[238],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[240,241,242,41,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":260,"name":261,"nameZh":6,"description":262,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":263,"categories":264,"keywords":266,"publishedAt":45},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[265],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[140,267,41,268,269,270,271,272,273,274,275,201,276,202,277,278,279,280,281,282],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]