网络安全 Analyzing Linux Elf Malware

Analyzing Linux Elf Malware：网络安全 skill: analyzing-linux-elf-malware，适用于安全分析、取证与威胁排查场景。

Skill Documentation

网络安全 Analyzing Linux Elf Malware

摘要

Analyzing Linux Elf Malware：网络安全 skill: analyzing-linux-elf-malware，适用于安全分析、取证与威胁排查场景。

> 来源: mukul975/Anthropic-Cybersecurity-Skills (18k stars) — 网络安全专业技能集

> 原文件: skills/analyzing-linux-elf-malware/SKILL.md

> 模型推荐: claude-opus-4-7 (安全分析深度推理)

这个 skill 是干嘛的

mukul975 整理的 100+ 个网络安全专业 skill,覆盖渗透测试 / 取证 / 威胁情报 / 合规审计 / 云安全 / 移动安全 等领域。每个 skill 对应一个具体的安全分析任务。

michael 强调"skill 要有相应的指导功能,指导用户使用",所以加了下面两节让 Agent 和用户对接。

---

🤖 Agent 使用说明

1. 用户提到"分析 X 日志 / 取证 / 检测威胁 / 渗透测试 / 安全审计"时,触发对应 skill

2. skill 会按操作步骤一步步执行(取证镜像 / 解析日志 / 跑威胁情报 / etc.)

3. 涉及破坏性操作(rm/drop/format)前必须 ask user 确认

4. 完工后让 Agent 跑自检 step

5. 如果用户要求做"防御性分析" — 区分恶意代码审计 vs 渗透测试

👤 用户需要做什么?

1. 告诉 Agent 你要做什么(分析日志 / 取证 / 安全审计 / 渗透测试)

2. 如果需要提供文件/镜像/日志/哈希,按 Agent 提示提供

3. 涉及破坏性操作时明确告诉 Agent"继续"或"取消"

4. 全程 Agent 自动化,你只需提供数据 + 回答决策点

---

原 skill 内容(mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-linux-elf-malware/SKILL.md,截断到 12k chars)

---

name: analyzing-linux-elf-malware

description: 'Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware,

and rootkits targeting Linux servers, containers, and cloud infrastructure — through

static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM samples.

Use when investigating Linux malware, triaging a suspicious ELF binary, assessing

a compromised Linux server, or analyzing container-targeted malware.

'

domain: cybersecurity

subdomain: malware-analysis

tags:

• malware
• Linux
• ELF
• reverse-engineering
• server-malware

version: 1.0.0

author: mahipal

license: Apache-2.0

nist_csf:

• DE.AE-02
• RS.AN-03
• ID.RA-01
• DE.CM-01

mitre_attack:

• T1027
• T1059.004
• T1620
• T1574.006

mitre_f3:

version: '1.1'

tactics:

• positioning
• monetization
• reconnaissance

techniques:

• id: T1219

name: Remote Access Tools

tactic: positioning

source: attack

• id: T1555

name: Credentials from Password Stores

tactic: reconnaissance

source: attack

• id: F1018

name: Convert to Cryptocurrency

tactic: monetization

source: f3

• id: F1047

name: Transfer of funds

tactic: monetization

source: f3

---

Analyzing Linux ELF Malware

When to Use

• A Linux server or container has been compromised and suspicious ELF binaries are found
• Analyzing Linux botnets (Mirai, Gafgyt, XorDDoS), cryptominers, or ransomware
• Investigating malware targeting cloud infrastructure, Docker containers, or Kubernetes pods
• Reverse engineering Linux rootkits and kernel modules
• Analyzing cross-platform malware compiled for Linux x86_64, ARM, or MIPS architectures

**Do not use** for Windows PE binary analysis; use PEStudio, Ghidra, or IDA for Windows malware.

Prerequisites

• Ghidra or IDA with Linux ELF support for disassembly and decompilation
• Linux analysis VM (Ubuntu 22.04 recommended) with development tools installed
• strace, ltrace, and GDB for dynamic analysis and debugging
• readelf, objdump, and nm from GNU binutils for static inspection
• Radare2 for quick binary triage and scripted analysis
• Docker for isolated container-based malware execution

Workflow

Step 1: Identify ELF Binary Properties

Examine the ELF header and basic properties:

# File type identification
file suspect_binary

# Detailed ELF header analysis
readelf -h suspect_binary

# Section headers
readelf -S suspect_binary

# Program headers (segments)
readelf -l suspect_binary

# Symbol table (if not stripped)
readelf -s suspect_binary
nm suspect_binary 2>/dev/null

# Dynamic linking information
readelf -d suspect_binary
ldd suspect_binary 2>/dev/null  # Only on matching architecture!

# Compute hashes
md5sum suspect_binary
sha256sum suspect_binary

# Check for packing/UPX
upx -t suspect_binary

# Python-based ELF analysis
from elftools.elf.elffile import ELFFile
import hashlib

with open("suspect_binary", "rb") as f:
    data = f.read()
    sha256 = hashlib.sha256(data).hexdigest()

with open("suspect_binary", "rb") as f:
    elf = ELFFile(f)

    print(f"SHA-256:      {sha256}")
    print(f"Class:        {elf.elfclass}-bit")
    print(f"Endian:       {elf.little_endian and 'Little' or 'Big'}")
    print(f"Machine:      {elf.header.e_machine}")
    print(f"Type:         {elf.header.e_type}")
    print(f"Entry Point:  0x{elf.header.e_entry:X}")

    # Check if stripped
    symtab = elf.get_section_by_name('.symtab')
    print(f"Stripped:     {'Yes' if symtab is None else 'No'}")

    # Section entropy analysis
    import math
    from collections import Counter
    for section in elf.iter_sections():
        data = section.data()
        if len(data) > 0:
            entropy = -sum((c/len(data)) * math.log2(c/len(data))
                          for c in Counter(data).values() if c > 0)
            if entropy > 7.0:
                print(f"  [!] High entropy section: {section.name} ({entropy:.2f})")

Step 2: Extract Strings and Indicators

Search for embedded IOCs and functionality clues:

# ASCII strings
strings suspect_binary > strings_output.txt

# Search for network indicators
grep -iE "(http|https|ftp)://" strings_output.txt
grep -iE "([0-9]{1,3}\.){3}[0-9]{1,3}" strings_output.txt
grep -iE "[a-zA-Z0-9.-]+\.(com|net|org|io|ru|cn)" strings_output.txt

# Search for shell commands
grep -iE "(bash|sh|wget|curl|chmod|/tmp/|/dev/)" strings_output.txt

# Search for crypto mining indicators
grep -iE "(stratum|xmr|monero|pool\.|mining)" strings_output.txt

# Search for SSH/credential theft
grep -iE "(ssh|authorized_keys|id_rsa|shadow|passwd)" strings_output.txt

# Search for persistence mechanisms
grep -iE "(crontab|systemd|init\.d|rc\.local|ld\.so\.preload)" strings_output.txt

# FLOSS for obfuscated strings (if available)
floss suspect_binary

Step 3: Analyze System Calls and Library Usage

Identify what system calls and libraries the malware uses:

# List imported functions (dynamically linked)
readelf -r suspect_binary | grep -E "socket|connect|exec|fork|open|write|bind|listen"

# Trace system calls during execution (in isolated VM only)
strace -f -e trace=network,process,file -o strace_output.txt ./suspect_binary

# Trace library calls
ltrace -f -o ltrace_output.txt ./suspect_binary

# Key system calls to watch:
# Network: socket, connect, bind, listen, accept, sendto, recvfrom
# Process: fork, execve, clone, kill, ptrace
# File:    open, read, write, unlink, rename, chmod
# Persistence: inotify_add_watch (file monitoring)

Step 4: Dynamic Analysis with GDB

Debug the malware to observe runtime behavior:

# Start GDB with the binary
gdb ./suspect_binary

# Set breakpoints on key functions
(gdb) break main
(gdb) break socket
(gdb) break connect
(gdb) break execve
(gdb) break fork

# Run and analyze
(gdb) run
(gdb) info registers    # View register state
(gdb) x/20s $rdi        # Examine string argument
(gdb) bt                # Backtrace
(gdb) continue

# For stripped binaries, break on entry point
(gdb) break *0x400580   # Entry point from readelf
(gdb) run

# Monitor network connections during execution
# In another terminal:
ss -tlnp  # List listening sockets
ss -tnp   # List established connections

Step 5: Reverse Engineer with Ghidra

Perform deep code analysis on the ELF binary:

Ghidra Analysis for Linux ELF:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
1. Import: File -> Import -> Select ELF binary
   - Ghidra auto-detects ELF format and architecture
   - Accept default analysis options

2. Key analysis targets:
   - main() function (or entry point if stripped)
   - Socket creation and connection functions
   - Command dispatch logic (switch/case on received data)
   - Encryption/encoding routines
   - Persistence installation code
   - Self-propagation/scanning functions

3. For Mirai-like botnets, look for:
   - Credential list for brute-forcing (telnet/SSH)
   - Attack module selection (UDP flood, SYN flood, ACK flood)
   - Scanner module (port scanning for vulnerable devices)
   - Killer module (killing competing botnets)

4. For cryptominers, look for:
   - Mining pool connection (stratum protocol)
   - Wallet address strings
   - CPU/GPU utilization functions
   - Process hiding techniques

Step 6: Analyze Linux-Specific Persistence

Check for persistence mechanisms:

# Check for LD_PRELOAD rootkit
strings suspect_binary | grep "ld.so.preload"
# Malware writing to /etc/ld.so.preload can hook all dynamic library calls

# Check for crontab persistence
strings suspect_binary | grep -i "cron"

# Check for systemd service creation
strings suspect_binary | grep -iE "systemd|\.service|systemctl"

# Check for init script creation
strings suspect_binary | grep -iE "init\.d|rc\.local|update-rc"

# Check for SSH key injection
strings suspect_binary | grep -i "authorized_keys"

# Check for kernel module (rootkit) loading
strings suspect_binary | grep -iE "insmod|modprobe|init_module"

# Check for process hiding
strings suspect_binary | grep -iE "proc|readdir|getdents"

Key Concepts

| Term | Definition |

|------|------------|

| **ELF (Executable and Linkable Format)** | Standard binary format for Linux executables, shared libraries, and core dumps containing headers, sections, and segments |

| **Stripped Binary** | ELF binary with debug symbols removed, making reverse engineering more difficult as function names are lost |

| **LD_PRELOAD** | Linux environment variable specifying shared libraries to load before all others; abused by rootkits to intercept system library calls |

| **strace** | Linux system call tracer that logs all system calls and signals made by a process, revealing file, network, and process operations |

| **GOT/PLT** | Global Offset Table and Procedure Linkage Table; ELF structures for dynamic linking that can be hijacked for function hooking |

| **Statically Linked** | Binary compiled with all library code included; common in IoT malware to run on systems without matching shared libraries |

| **Mirai** | Prolific Linux botnet targeting IoT devices via telnet brute-force; source code leaked, leading to many variants |

Tools & Systems

• **Ghidra**: NSA reverse engineering tool with full ELF support for x86, x86_64, ARM, MIPS, and other Linux architectures
• **Radare2**: Open-source reverse engineering framework with command-line interface for quick binary analysis and scripting
• **strace**: Linux system call tracing tool for observing binary behavior including file, network, and process operations
• **GDB**: GNU Debugger for setting breakpoints, examining memory, and stepping through Linux binary execution
• **pyelftools**: Python library for parsing ELF files programmatically for automated analysis pipelines

Common Scenarios

Scenario: Analyzing a Cryptominer Found on a Compromised Linux Server

**Context**: A cloud server shows 100% CPU usage. Investigation reveals an unknown binary running from /tmp with a suspicious name. The binary needs analysis to confirm it is a cryptominer and identify the attacker's wallet and pool.

**Approach**:

1. Copy the binary to an analysis VM and compute SHA-256 hash

2. Run `file` and `readelf` to identify architecture and linking type

3. Extract strings and search for mining pool addresses (stratum+tcp://) and wallet addresses

4. Run with strace in a sandbox to observe network connections (mining pool connection)

5. Import into Ghidra to identify the mining algorithm and configuration extraction

6. Check for persistence mechanisms (crontab, systemd service, SSH keys)

7. Document all IOCs including pool address, wallet, C2 for updates, and persistence artifacts

**Pitfalls**:

• Running `ldd` on malware outside a sandbox (ldd can execute code in the binary)
• Not checking for ARM/MIPS architecture before attempting x86_64 execution
• Missing companion scripts (.sh files) that may handle persistence and cleanup
• Ignoring the initial access vector (how the miner was deployed: SSH brute force, web exploit, container escape)

Output Format

LINUX ELF MALWARE ANALYSIS REPORT
====================================
File:             /tmp/.X11-unix/.rsync
SHA-256:          e3b0c44298fc1c149afbf4c8996fb924...
Type:             ELF 64-bit LSB executable, x86-64
Linking:          Statically linked (all libraries embedded)
Stripped:         Yes
Size:             2,847,232 bytes
Packer:           UPX 3.96 (unpacked for analysis)

CLASSIFICATION
Family:           XMRig Cryptominer (modified)
Variant:          Custom build with C2 update mechanism

FUNCTIONALITY
[*] XMR (Monero) mining via RandomX algorithm
[*] Stratum pool connection for work submission
[*] C2 check-in for configuration updates
[*] Process name masquerading (argv[0] = "[kworker/0:0]")
[*] Competitor process killing (kills other miners)
[*] SSH key injection for re-access

NETWORK INDICATORS
Mining Pool:      stratum+tcp://pool.minexmr[.]com:4444
C2 Server:        hxxp://update.malicious[.]com/

## 常见问题（FAQ）

## 使用「Analyzing Linu」这个 skill 能解决什么问题?
本 skill 专注于Analyzing Linu，网络安全 skill: analyzing-linux-elf-malware。它将相关流程标准化，帮助用户更快拿到可靠结果，减少重复手工操作。

## 什么情况下适合使用「Analyzing Linu」?
当你需要在Analyzing Linux Elf Malware相关工作中获得稳定、可复用的产出时最适合——无论是单次任务还是纳入日常工作流，都能直接调用。

## 使用「Analyzing Linu」前需要准备什么?
需要明确授权范围内的目标系统或样本文件，并准备隔离的分析环境（虚拟机/沙箱）。