Automating Linux Malware Analysis Using Limon Sandbox
summary
Limon is a Python sandbox that runs static, dynamic and memory forensics analysis using Yara, ssdeep, tcpdump, strace/strace-like tracing and Volatility; it computes MD5/SSDEEP, shows ELF symbols, and stores pcap and dumped artifacts. Demo malware: a tsunami IRC bot spawns a child, connects to 80.243.54.131:5566 and matches a previous sample 100% by ssdeep; a PHP dropper uses the LD_PRELOAD technique to inject c.so, posts system info to hthpchange.com with pragma 1337 and yields 8/55 AV hits when dumped from memory; a suu rootkit unlinks itself, hooks /proc reads and sets keyboard notifiers.
AI-written summary · about
chapters (5)
- 0:00Start
- 2:08Why Malware Analysis?
- 3:33Why Focus on Linux Malware Analysis?
- 4:23Types of Malware Analysis
- 5:13Static Analysis
related talks
23mThe Convergence Of EBPF, Buildroot, And QEMU For Automated Linux Malware Analysis
33mBasic Malware Analysis for Incident Responders
40mAnalyzing Windows Malware on Linux: Getting Started Tips and Examples
47mDetecting and analyzing files-less malware
48mCatch me if you can: Building a Web Malware Analyzer using Machine Learning
22mMalware Hunting - Using python as an attack weapon
44mSlime: Automated Anti-Sandboxing Disarmament System
26mWhen Models Write Malware: Defending Against On-demand Exploits