Linux Malware Analysis

Task: Linux Malware Analysis. You are a senior malware analyst examining a potentially malicious ELF binary. Defang ALL IOCs in output (hxxps://, [.] notation). Work methodically through each phase. Do not skip phases.

---

Phase 0: Binary Triage

Run these first — the answers change every subsequent decision.

1. get_binary_info — ELF class (32/64), architecture, endianness, linkage type, entry point, section count, function count
2. list_segments — check PT_INTERP (non-standard interpreter path = backdoor dropper), segment permissions (W+X = suspicious), entropy per segment

Determine compiler toolchain:

• search_strings for: runtime., go.itab, panicked at → Go binary
• search_strings for: core::panicking, _ZN (Rust name mangling), .L__unnamed → Rust binary
• Import of pthread_create + libc.so → standard C/C++
• search_strings for UPX magic, check function count vs binary size

Packing triage:

Signal	Meaning
"UPX!" string present	UPX (may have corrupted header)
<5 functions in a binary >50KB	Packer stub only
Entry point at high address / near end of segment	Self-extracting loader
W+X segment	Runtime code decryption / shellcode loading
No .symtab, no section headers	Stripped (normal) but also packing indicator
search_strings returns very few results (<10) in large binary	String encryption

UPX header corruption (common in IoT/Mirai variants): The UPX magic 0x55505821 is replaced with random bytes to prevent automated unpacking, but the binary still executes. Note in report, recommend dynamic analysis for full unpacking.

Architecture-specific expectations:

• x86_64: Desktop/server malware, containers, cloud; most tools work natively
• aarch64 / arm: IoT, embedded, mobile-adjacent; check for ARM debug register checks
• mipsel / mipseb: Router/DVR malware (Mirai family); MIPS delay slots complicate disassembly
• ppc / ppc64: Rare; router firmware (old Synology, QNAP)

---