The Convergence Of EBPF, Buildroot, And QEMU For Automated Linux Malware Analysis
summary
An automated pipeline that combines ELFEN sandbox with Buildroot-built QEMU images and the lightweight ply tracer uses eBPF kprobes/kretprobes/tracepoints to record behavior across x86_64, MIPS (LE/BE), PowerPC BE and ARMv5 targets. Static YARA and dynamic Python detectors score behaviors (e.g., ransomware rename sequences scored 30–100) and memory-dumped YARA finds AvosLocker artifacts; Mirai C2 79.110.49.85:9375 is observed. The system runs samples in Dockerized VMs, handles corrupted ELF headers at runtime, and is open-sourced on GitHub.
AI-written summary · about
chapters (6)
- 0:00Speaker and Talk Introduction
- 1:26Talk Agenda
- 1:54extended Berkeley Packet Filter (eBPF)
- 12:04ELFEN Sandbox
- 14:19Demo Analysis with ELFEN
- 22:18Future Work
related talks
40mAnalyzing Windows Malware on Linux: Getting Started Tips and Examples
33mBasic Malware Analysis for Incident Responders
56mAutomating Linux Malware Analysis Using Limon Sandbox
40mThreat From The Inside: Investigate eBPF Malware
51meBPF Warfare - Detecting Kernel & eBPF Rootkits with Tracee
40mExploring Runtime Security and Forensic using eBPF
20mThink eBPF for Kernel Security Monitoring
47mDetecting and analyzing files-less malware