Malware Analysis Space

  Summary RapperBot is a malware family primarily targeting IoT devices. It has been observed in the wild since June 2022. Recently, the other variant of this botnet was noted by the Chinese cybersecurity team on 2025/1/28, which did a large-scale malicious attack on Chinese AI startup DeepSeek, which attracted my curiosity, So I looked for one variant, which is an early version, to analyze that belongs to the ARM architecture.     Technical analysis This Rapperbot is the ELF for ARM (executable). The hash MD5: EF9EBF4D5A1A44D0DB92DE06D3DCE7A1 This variant focuses on the TCP DoS attack and not on doing a brute force like a telnet server and not on doing vulnerability exploits. Figure1-DoS attack   Before starting a DoS attack, the code creates a UDP socket, the port is 13568 , connects it to a remote address, retrieves the local socket details, and then closes the socket, and finally returns the value 134744072. Figure2-Retrieving socket detail t...

  Summary HailBot is the variant of the Marai botnet. This botnet is very popular in 2023 and later became faster, delivering and infecting large-scale. Recently, the other variant of this botnet was noted by the Chinese cybersecurity team on 2025/1/28, which did a large-scale malicious attack on Chinese AI startup deepseek.     Technical analysis This HailBot is the ELF for ARM (executable). The hash MD5: 74AE300E854410ABB8C71A9E5C6182FF   The HailBot kills the other botnet to ensure that it is the only one running on the victim host. Figure1-Kill other botnet   The botnet kills other processes. Figure2-Kill other processes   HailBot disguises itself to hide the process with the mount. Figure3-Hide process   Supporting TCP and UDP DDoS attacks that are imbedded inside the botnet, which has more than 10 different DDoS attack ways. Firgure4-DDoS attack mode   HailBot is the variant of the Marai botnet, which is focused...