{"type":"rich","version":"1.0","provider_name":"Transistor","provider_url":"https://transistor.fm","author_name":"Cybersecurity Tech Brief By HackerNoon","title":"Static Analysis of Linux Malware Captured by a Cowrie Honeypot","html":"","width":"100%","height":180,"duration":2230,"description":"\n This story was originally published on HackerNoon at: https://hackernoon.com/static-analysis-of-linux-malware-captured-by-a-cowrie-honeypot.\nA defensive, static deep dive into the Linux malware a honeypot captured after weak logins: fake daemons, persistent backdoors, relay abuse, and detections.\nCheck more stories related to cybersecurity at: https://hackernoon.com/c/cybersecurity.\n You can also check exclusive content about #malware-analysis, #linux-malware, #honeypot, #botnets, #threat-intelligence, #iot-security, #mitre-attack, #hackernoon-top-story, and more.\nThis story was written by: @arizh0. Learn more about this writer by checking @arizh0's about page,\n and for more stories, please visit hackernoon.com.\nWhen a bot thinks it has logged into a small energy device, it installs commodity Linux malware. This is a static, defensive breakdown of what a honeypot captured after weak SSH and Telnet logins: fake-daemon binaries that masquerade as sshd and xinetd, a statically linked bot, a backdoor with three independent persistence mechanisms, and a self-deleting campaign visible only through commands. The payloads are ordinary, but the chain is the lesson: weak login, host fingerprint, payload staging, persistence, and reach-out. Default-deny egress breaks the last step.\n \n ","thumbnail_url":"https://img.transistorcdn.com/SySK4I0jwuU6AzeawZdYiDqTq8yzBjxJ5qfTpUuAxEo/rs:fill:0:0:1/w:400/h:400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS9zaG93/LzQxMjY2LzE2ODM1/ODIzNTYtYXJ0d29y/ay5qcGc.webp","thumbnail_width":300,"thumbnail_height":300}