Episode Details

This story was originally published on HackerNoon at: https://hackernoon.com/static-analysis-of-linux-malware-captured-by-a-cowrie-honeypot.
A defensive, static deep dive into the Linux malware a honeypot captured after weak logins: fake daemons, persistent backdoors, relay abuse, and detections.
Check more stories related to cybersecurity at: https://hackernoon.com/c/cybersecurity. You can also check exclusive content about #malware-analysis, #linux-malware, #honeypot, #botnets, #threat-intelligence, #iot-security, #mitre-attack, #hackernoon-top-story, and more.

This story was written by: @arizh0. Learn more about this writer by checking @arizh0's about page, and for more stories, please visit hackernoon.com.

When a bot thinks it has logged into a small energy device, it installs commodity Linux malware. This is a static, defensive breakdown of what a honeypot captured after weak SSH and Telnet logins: fake-daemon binaries that masquerade as sshd and xinetd, a statically linked bot, a backdoor with three independent persistence mechanisms, and a self-deleting campaign visible only through commands. The payloads are ordinary, but the chain is the lesson: weak login, host fingerprint, payload staging, persistence, and reach-out. Default-deny egress breaks the last step.