Curt Johnson - Indie GeniusMovie TV Tech Geeks #TV #Anime #Kaiji #MyHomeHero 10 Anime Series That Would Work as Prestige HBO Dramas, Ranked http://dlvr.it/TQz0q6
ANY.RUN🚨 Expose Evasion Tricks in Linux Malware
Many #Linux botnets and cryptominers hide by replacing system utilities like ps, ls, or netstat. This allows attackers to control what the system reports and conceal malicious activity.
⚠️ Two core techniques make infected systems look clean while attackers remain persistent and unnoticed:
1️⃣ Proxy replacement
The original utility is renamed and moved to another directory, and a malicious proxy takes its place. When the user runs the expected command, the proxy forwards the request to the real binary but filters the output, hiding malicious processes, files, or network activity.
2️⃣ Full replacement
Attackers delete the original utility and replace it with a version that fully imitates its functionality. Since tools like ps, ls, or netstat read directly from filesystem data, they are easy to clone. The malicious version returns normal output while hiding any traces of the botnet or miner.
👨💻 See the analysis of the #Kaiji botnet using full replacement to stay hidden: https://app.any.run/tasks/8c6b9b68-81ac-40d1-a070-ee93750357c7/?utm_source=mastodon&utm_medium=post&utm_campaign=linux_evasion_techniques&utm_term=261125&utm_content=linktoservice
🎯 TTPs:
Create or Modify System Process (T1543): Replaces legitimate system utilities with modified versions.
Indicator Blocking (T1054): Filters output to block indicators.
Masquerading (T1036): Disguises malicious binaries as system utilities.
⚡ Gain fast detection and full visibility into threats across Windows, Linux, and Android with #ANYRUN. Sign up: https://app.any.run/?utm_source=mastodon&utm_medium=post&utm_campaign=linux_evasion_techniques&utm_term=261125&utm_content=register#register
✦
whim 𓆗
deflectric
yung gribble
lask
