This story was originally published on HackerNoon at:
https://hackernoon.com/static-analysis-of-linux-malware-captured-by-a-cowrie-honeypot.
A defensive, static deep dive into the Linux malware a honeypot captured after weak logins: fake daemons, persistent backdoors, relay abuse, and detections.
Check more stories related to cybersecurity at:
https://hackernoon.com/c/cybersecurity.
You can also check exclusive content about
#malware-analysis,
#linux-malware,
#honeypot,
#botnets,
#threat-intelligence,
#iot-security,
#mitre-attack,
#hackernoon-top-story, and more.
This story was written by:
@arizh0. Learn more about this writer by checking
@arizh0's about page,
and for more stories, please visit
hackernoon.com.
When a bot thinks it has logged into a small energy device, it installs commodity Linux malware. This is a static, defensive breakdown of what a honeypot captured after weak SSH and Telnet logins: fake-daemon binaries that masquerade as sshd and xinetd, a statically linked bot, a backdoor with three independent persistence mechanisms, and a self-deleting campaign visible only through commands. The payloads are ordinary, but the chain is the lesson: weak login, host fingerprint, payload staging, persistence, and reach-out. Default-deny egress breaks the last step.