<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-linux-elf-malware
description: >-
  Analyze Linux ELF malware including static analysis, dynamic tracing, rootkit
  detection, and reverse engineering of IoT/server-targeting threats.
domain: cybersecurity
subdomain: malware-analysis
tags:
  - elf-analysis
  - linux-malware
  - rootkit
  - iot-malware
  - reverse-engineering
  - strace
  - gdb
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1587.001"]
---

# Analyzing Linux ELF Malware

## Overview

Linux malware targeting servers, IoT devices, cloud infrastructure, and containers is growing rapidly. ELF (Executable and Linkable Format) malware includes cryptominers, DDoS bots (Mirai variants), ransomware, rootkits, and backdoors. Analysis requires understanding ELF format internals, Linux syscall interfaces, dynamic linking, and architecture-specific considerations (x86_64, ARM, MIPS for IoT). Key tools include readelf, objdump, strace, ltrace, GDB, and Ghidra for cross-architecture reverse engineering.

## Prerequisites

- REMnux or dedicated Linux analysis VM
- Python 3.10+ with `lief`, `pyelftools`, `capstone`
- `readelf`, `objdump`, `file`, `strings` (binutils)
- `strace`, `ltrace` for dynamic tracing
- GDB with GEF/pwndbg for debugging
- Ghidra for cross-architecture disassembly
- QEMU for non-native architecture emulation (ARM, MIPS)
- Isolated network (no production access)

## Key Concepts

### ELF Structure

| Component | Purpose | Analysis Value |
|-----------|---------|---------------|
| ELF Header | Magic, architecture, entry point | Identify target arch |
| Program Headers | Segment loading instructions | Memory layout |
| Section Headers | Named sections (.text, .data, .rodata) | Code/data organization |
| Symbol Table | Function/variable names | If not stripped |
| Dynamic Section | Shared library dependencies | Imported functions |
| .init/.fini | Constructor/destructor functions | Auto-execution code |
| .plt/.got | Procedure Linkage / Global Offset Table | Dynamic linking |

### Common Linux Malware Families

| Family | Type | Target | Indicators |
|--------|------|--------|-----------|
| Mirai | DDoS botnet | IoT (ARM, MIPS) | Telnet brute-force, /tmp drops |
| XorDDoS | DDoS + rootkit | x86 servers | XOR-encoded config, /lib/libudev.so |
| Mozi | P2P botnet | IoT routers | DHT protocol, CVE exploitation |
| Sysrv | Cryptominer | Cloud/containers | XMRig, lateral movement |
| BPFDoor | Backdoor | Servers | BPF socket filter, no listening port |
| Symbiote | Rootkit | Servers | LD_PRELOAD hijacking |

## Workflow

### Step 1: ELF Triage

```bash
# File identification
file sample.elf
readelf -h sample.elf  # ELF header (arch, entry point, type)

# Hash generation
sha256sum sample.elf
ssdeep sample.elf

# Check if stripped
file sample.elf | grep -c "not stripped"
readelf -s sample.elf | head -20  # Symbol table

# String extraction
strings -a -n 6 sample.elf | sort -u > strings.txt
strings -a -el sample.elf >> strings.txt  # Wide strings

# Quick indicators
grep -iE 'http|https|ftp|/tmp/|/dev/|ssh|telnet|shell|password|root|chmod|wget|curl' strings.txt

# Library dependencies
ldd sample.elf 2>/dev/null || readelf -d sample.elf | grep NEEDED

# Section analysis
readelf -S sample.elf
```

### Step 2: Static Analysis with Python

```python
#!/usr/bin/env python3
"""ELF malware static analyzer."""
import lief
import math

def analyze_elf(filepath: str) -> dict:
    binary = lief.parse(filepath)
    if binary is None:
        return {"error": "Failed to parse ELF"}

    result = {
        "file": filepath,
        "type": str(binary.header.file_type).split(".")[-1],
        "arch": str(binary.header.machine_type).split(".")[-1],
        "entry_point": hex(binary.header.entrypoint),
        "is_pie": binary.is_pie,
        "has_nx": binary.has_nx,
        "is_stripped": len(list(binary.static_symbols)) == 0,
        "sections": [],
        "imported_functions": [],
        "suspicious_imports": [],
        "libraries": [],
    }

    # Section analysis with entropy
    for section in binary.sections:
        data = bytes(section.content)
        entropy = 0.0
        if data:
            freq = [0] * 256
            for b in data:
                freq[b] += 1
            length = len(data)
            entropy = -sum(
                (f / length) * math.log2(f / length)
                for f in freq if f > 0
            )
        result["sections"].append({
            "name": section.name,
            "size": section.size,
            "entropy": round(entropy, 2),
            "flags": str(section.flags),
        })

    # Import analysis
    suspicious_funcs = {
        "system", "execve", "execvp", "popen", "fork", "clone",
        "ptrace", "mprotect", "mmap", "dlopen", "dlsym",
        "connect", "socket", "bind", "listen", "accept",
        "sendto", "recvfrom", "shmget", "kill", "unlink",
        "chmod", "chown", "setuid", "setgid", "chroot",
    }

    for func in binary.imported_functions:
        result["imported_functions"].append(func.name)
        if func.name in suspicious_funcs:
            result["suspicious_imports"].append(func.name)

    # Library dependencies
    for lib in binary.libraries:
        result["libraries"].append(lib)

    return result

if __name__ == "__main__":
    import sys, json
    print(json.dumps(analyze_elf(sys.argv[1]), indent=2))
```

### Step 3: Dynamic Analysis with strace/ltrace

```bash
# Trace system calls
strace -f -e trace=network,process,file -o strace.log timeout 60 ./sample.elf

# Trace library calls
ltrace -f -e '*' -o ltrace.log timeout 60 ./sample.elf

# Network-only trace
strace -f -e trace=network -o network_trace.log timeout 60 ./sample.elf

# File access trace
strace -f -e trace=open,openat,creat,unlink,rename,chmod -o file_trace.log timeout 60 ./sample.elf

# Process creation trace
strace -f -e trace=clone,fork,execve -o process_trace.log timeout 60 ./sample.elf

# Analyze strace output
grep -E 'connect|sendto|recvfrom' strace.log         # Network connections
grep -E 'open|openat|creat|unlink' strace.log        # File operations
grep -E 'execve|clone|fork' strace.log               # Process creation
grep -E 'socket|bind|listen' strace.log              # Server setup
```

### Step 4: Cross-Architecture Analysis (IoT)

```bash
# Identify architecture
readelf -h sample.elf | grep Machine
# Common IoT: ARM, MIPS, MIPS-LE, PowerPC, SPARC

# Emulate with QEMU user mode
qemu-arm-static ./sample_arm
qemu-mipsel-static ./sample_mipsel

# Emulate with strace
qemu-arm-static -strace ./sample_arm 2>strace_arm.log

# Ghidra headless analysis for non-native arch
analyzeHeadless /tmp/project IoTAnalysis \
  -import sample_arm \
  -processor ARM:LE:32:v7 \
  -postScript ExportFunctions.py
```

### Step 5: Rootkit Detection

```bash
# Check for LD_PRELOAD hijacking
echo $LD_PRELOAD
cat /etc/ld.so.preload
ls -la /etc/ld.so.preload

# Check for hidden processes
ps aux | wc -l
ls /proc/ | grep -E '^[0-9]+$' | wc -l
# Mismatch = hidden processes

# Check loaded kernel modules
lsmod
cat /proc/modules

# Verify system binaries
rpm -V coreutils  # RPM-based systems
debsums -c        # Debian-based systems

# Check for BPF filters (BPFDoor-style)
ss -0pb           # Show BPF programs on sockets
bpftool prog list # List BPF programs

# Check for /dev/shm drops
ls -la /dev/shm/
ls -la /tmp/ /var/tmp/ /run/
```

## Detection

```yaml
title: Linux Elf Malware Detection
id: 05cdc21f-42ad-43d6-a4f0-a297163f81a9
status: experimental
description: Detects suspicious activity related to analyzing linux elf malware techniques in malware analysis context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*analyzing*linux*"
  condition: selection
level: high
tags:
  - attack.t1587.001
  - attack.execution
falsepositives:
  - Sandbox detonation environments analyzing submitted samples
```

## Verification

- [ ] ELF type, architecture, and entry point identified
- [ ] Static analysis complete (imports, strings, sections)
- [ ] Dynamic behavior captured (syscalls, file ops, network)
- [ ] Cross-architecture emulation successful (if IoT)
- [ ] Rootkit indicators checked
- [ ] C2 infrastructure identified
- [ ] YARA rule written for detection
- [ ] IOCs extracted and documented

## References

- [REMnux - Linux Malware Analysis Distro](https://remnux.org/)
- [LIEF - Library for ELF Analysis](https://lief-project.github.io/)
- [MITRE ATT&CK for Linux](https://attack.mitre.org/matrices/enterprise/linux/)
- [Mirai Botnet Source Analysis](https://github.com/jgamblin/Mirai-Source-Code)
- [Intezer - Linux Malware Research](https://www.intezer.com/blog/research/)
