analyzing-linux-elf-malware

name	analyzing-linux-elf-malware
description	Use when analyzing malicious Linux ELF (Executable and Linkable Format) binaries including botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure. Covers static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM ELF samples. Activates for requests involving Linux malware analysis, ELF binary investigation, Linux server compromise assessment, or container malware analysis.
domain	cybersecurity
tags	["malware","Linux","ELF","reverse-engineering","server-malware"]
subdomain	malware-analysis
version	1.0.0
author	oyi77
license	Apache-2.0
nist_csf	["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"]

Analyzing Linux Elf Malware

Overview

Cybersecurity skill for analyzing linux elf malware. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "analyzing linux elf malware"

• "Analyzes malicious Linux ELF (Executable and Linkable Format) binaries including"

• A Linux server or container has been compromised and suspicious ELF binaries are found

• Analyzing Linux botnets (Mirai, Gafgyt, XorDDoS), cryptominers, or ransomware

• Investigating malware targeting cloud infrastructure, Docker containers, or Kubernetes pods

• Reverse engineering Linux rootkits and kernel modules

• Analyzing cross-platform malware compiled for Linux x86_64, ARM, or MIPS architectures

Do not use for Windows PE binary analysis; use PEStudio, Ghidra, or IDA for Windows malware.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Ghidra or IDA with Linux ELF support for disassembly and decompilation
• Linux analysis VM (Ubuntu 22.04 recommended) with development tools installed
• strace, ltrace, and GDB for dynamic analysis and debugging
• readelf, objdump, and nm from GNU binutils for static inspection
• Radare2 for quick binary triage and scripted analysis
• Docker for isolated container-based malware execution

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}