Limon

Limon - 用于分析Linux恶意软件的沙箱 Limon 是一个作为研究项目开发的沙箱，使用 Python 编写，能够自动收集、分析并报告 Linux 恶意软件的运行时指标。它允许用户在恶意软件执行前、执行期间及执行后（事后分析）通过使用开源工具进行静态分析、动态分析和内存分析来检查 Linux 恶意软件。Limon 在受控环境中分析恶意软件，监控其活动及子进程，以确定恶意软件的性质和目的。它能够确定恶意软件的进程活动、与文件系统和网络的交互，同时执行内存分析并存储分析后的人工制品以备后续分析。 使用 Limon 分析 Linux 恶意软件...

MalwareSourceCode

由 vx-underground 管理 | 在 Twitter 上关注我们 | 在 VXUG/samples 页面下载恶意软件样本 免责声明： 在适用法律允许的最大范围内，vx-underground 和/或向 vx-underground 提交内容的关联方，不对任何间接、附带、特殊、后果性或惩罚性损害赔偿，或任何直接或间接产生的利润或收入损失，或任何数据、使用、商誉或其他无形损失负责，这些损失源于 i 您访问本资源和/或无法访问本资源；ii 本资源引用的任何第三方的任何行为或内容，包括但不限于其他用户或第三方的任何诽谤、冒犯或非法行为；iii 从本资源获取的任何内容 说明...

linux-malware

linux-malware 此仓库最近7天的更新视图 提交内容? 新闻/学术界 https://en.wikipedia.org/wiki/Linuxmalware 17 - Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact, DarkSide https://rp.os3.nl/...

sandfly-entropyscan

What is sandfly-entropyscan? sandfly-entropyscan is a utility to quickly scan files or running processes and report on their entropy measure of randomness and if they are a Linux/Unix ELF type executable. Some malware for Linux is packed or encrypted and shows very high entropy. This tool can...

sandfly-entropyscan

sandfly-entropyscan 是什么？ sandfly-entropyscan 是一个实用工具，用于快速扫描文件或正在运行的进程，并报告它们的熵（随机性度量）以及是否为 Linux/Unix ELF 类型可执行文件。一些 Linux 恶意软件被打包或加密，显示出非常高的熵。该工具可以快速找到高熵的可执行文件和进程，这些通常都是恶意的。 功能特性 用 Golang 编写，无需修改即可跨多种架构移植。 独立的二进制文件无需依赖，可在可疑机器上立即使用，无需加载任何库。 不受隐藏文件的 LDPRELOAD 风格 Rootkit 影响。 内置 PID...

linux-malware-detect

Linux Malware Detect LMD Malware scanner for Linux — multi-stage threat detection MD5, SHA-256, HEX, YARA, statistical analysis, ClamAV integration, real-time inotify monitoring, quarantine/clean/restore operations, and multi-channel alerting email, Slack, Telegram, Discord. C 2002-2026, R-fx...

linux-malware-detect

Linux Malware Detect LMD Escáner de malware para Linux — detección de amenazas de múltiples etapas MD5, SHA-256, HEX, YARA, análisis estadístico, integración con ClamAV, monitorización en tiempo real con inotify, operaciones de cuarentena/limpieza/restauración y alertas multicanal correo...

yara-rules

yara-rules Colección de firmas YARA de investigaciones recientes de malware Conjunto de reglas Dacls Trojan Regla: DaclsLinux.yara Regla: DaclsWindows.yara Referencia: https://blog.netlab.360.com/dacls-the-dual-platform-rat/ APT32 KerrDown Regla: APT32KerrDown.yara Referencia:...

Showboat Linux Malware Hits Middle East Telecom with SOCKS5 Proxy Backdoor

Cybersecurity researchers have disclosed details of a new Linux malware dubbed Showboat that has been put to use in a campaign targeting a telecommunications provider in the Middle East since at least mid-2022. "Showboat is a modular post-exploitation framework designed for Linux systems, capable...

linux-malware-toolbox

Linux Malware Samples - Educational Repository ⚠️ IMPORTAN...

linux-malwares

Linux Malware Samples - Educational Repository ⚠️ IMPORTAN...

VoidLink Linux Malware Framework Built with AI Assistance Reaches 88,000 Lines of Code

The recently discovered sophisticated Linux malware framework known as VoidLink is assessed to have been developed by a single person with assistance from an artificial intelligence AI model. That's according to new findings from Check Point Research, which identified operational security blunder...

New China Linked VoidLink Linux Malware Targets Major Cloud Providers

Researchers have discovered VoidLink, a sophisticated new Linux malware framework designed to infiltrate AWS, Google Cloud, and Azure. Learn how this Chinese-affiliated toolkit uses adaptive stealth to stay hidden...

New Advanced Linux VoidLink Malware Targets Cloud and container Environments

Cybersecurity researchers have disclosed details of a previously undocumented and feature-rich malware framework codenamed VoidLink that's specifically designed for long-term, stealthy access to Linux-based cloud environments According to a new report from Check Point Research, the cloud-native...

China-Linked UAT-7290 Targets Telecoms with Linux Malware and ORB Nodes

A China-nexus threat actor known as UAT-7290 has been attributed to espionage-focused intrusions against entities in South Asia and Southeastern Europe. The activity cluster, which has been active since at least 2022, primarily focuses on extensive technical reconnaissance of target organizations...

ThreatsDay Bulletin: Wi-Fi Hack, npm Worm, DeFi Theft, Phishing Blasts— and 15 More Stories

Think your Wi-Fi is safe? Your coding tools? Or even your favorite financial apps? This week proves again how hackers, companies, and governments are all locked in a nonstop race to outsmart each other. Here's a quick rundown of the latest cyber stories that show how fast the game keeps changing...

APT36 Targets Indian Government with Golang-Based DeskRAT Malware Campaign

A Pakistan-nexus threat actor has been observed targeting Indian government entities as part of spear-phishing attacks designed to deliver a Golang-based malware known as DeskRAT. The activity, observed in August and September 2025 by Sekoia, has been attributed to Transparent Tribe aka APT36, a...

EUVD-2025-13634

Malicious code in bioql PyPI...

CHILLYHELL macOS Backdoor and ZynorRAT RAT Threaten macOS, Windows, and Linux Systems

Cybersecurity researchers have discovered two new malware families, including a modular Apple macOS backdoor called CHILLYHELL and a Go-based remote access trojan RAT named ZynorRAT that can target both Windows and Linux systems. According to an analysis from Jamf Threat Labs, ChillyHell is writt...

Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection

Cybersecurity researchers have shed light on a novel attack chain that employs phishing emails to deliver an open-source backdoor called VShell. The "Linux-specific malware infection chain that starts with a spam email with a malicious RAR archive file," Trellix researcher Sagar Bade said in a...