Malware Analysis Space

  Summary RapperBot is a malware family primarily targeting IoT devices. It has been observed in the wild since June 2022. Recently, the other variant of this botnet was noted by the Chinese cybersecurity team on 2025/1/28, which did a large-scale malicious attack on Chinese AI startup DeepSeek, which attracted my curiosity, So I looked for one variant, which is an early version, to analyze that belongs to the ARM architecture.     Technical analysis This Rapperbot is the ELF for ARM (executable). The hash MD5: EF9EBF4D5A1A44D0DB92DE06D3DCE7A1 This variant focuses on the TCP DoS attack and not on doing a brute force like a telnet server and not on doing vulnerability exploits. Figure1-DoS attack   Before starting a DoS attack, the code creates a UDP socket, the port is 13568 , connects it to a remote address, retrieves the local socket details, and then closes the socket, and finally returns the value 134744072. Figure2-Retrieving socket detail t...

  Summary HailBot is the variant of the Marai botnet. This botnet is very popular in 2023 and later became faster, delivering and infecting large-scale. Recently, the other variant of this botnet was noted by the Chinese cybersecurity team on 2025/1/28, which did a large-scale malicious attack on Chinese AI startup deepseek.     Technical analysis This HailBot is the ELF for ARM (executable). The hash MD5: 74AE300E854410ABB8C71A9E5C6182FF   The HailBot kills the other botnet to ensure that it is the only one running on the victim host. Figure1-Kill other botnet   The botnet kills other processes. Figure2-Kill other processes   HailBot disguises itself to hide the process with the mount. Figure3-Hide process   Supporting TCP and UDP DDoS attacks that are imbedded inside the botnet, which has more than 10 different DDoS attack ways. Firgure4-DDoS attack mode   HailBot is the variant of the Marai botnet, which is focused...

  Summary Since 2016, when the Mirai source code was published, similar family botnets have emerged; more and more botnets have appeared. and IoT security has become a big challenge. That makes me care about botnet development and do research. Recently, Mirai attracts me again; I like to do analysis with it in a different way, so here it is.   Analysis   Protect and Disguise Itself Like any other malware that does anti-debug from an analyst, Mirai uses the function anti_gdb_entry with one parameter to monitor gdb debug. If it discovers debugging, it executes the function unlink to delete itself and tries to prevent the watchdog from rebooting the device and keep itself running all the time, not offline. Figure1-anti-debug, delete self and keeping running   Using a random string which the length can be either 12, 16, 20, or 24 as name of processes and execute util_strcpy function for copying string to args[0] and hiding a real name. Figure2-Hide argv0 ...