linux-malware

linux-malware 此仓库最近7天的更新视图 提交内容? 新闻/学术界 https://en.wikipedia.org/wiki/Linuxmalware 17 - Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact, DarkSide https://rp.os3.nl/...

sandfly-entropyscan

What is sandfly-entropyscan? sandfly-entropyscan is a utility to quickly scan files or running processes and report on their entropy measure of randomness and if they are a Linux/Unix ELF type executable. Some malware for Linux is packed or encrypted and shows very high entropy. This tool can...

sandfly-entropyscan

sandfly-entropyscan 是什么？ sandfly-entropyscan 是一个实用工具，用于快速扫描文件或正在运行的进程，并报告它们的熵（随机性度量）以及是否为 Linux/Unix ELF 类型可执行文件。一些 Linux 恶意软件被打包或加密，显示出非常高的熵。该工具可以快速找到高熵的可执行文件和进程，这些通常都是恶意的。 功能特性 用 Golang 编写，无需修改即可跨多种架构移植。 独立的二进制文件无需依赖，可在可疑机器上立即使用，无需加载任何库。 不受隐藏文件的 LDPRELOAD 风格 Rootkit 影响。 内置 PID...

Limon

Limon - 用于分析Linux恶意软件的沙箱 Limon 是一个作为研究项目开发的沙箱，使用 Python 编写，能够自动收集、分析并报告 Linux 恶意软件的运行时指标。它允许用户在恶意软件执行前、执行期间及执行后（事后分析）通过使用开源工具进行静态分析、动态分析和内存分析来检查 Linux 恶意软件。Limon 在受控环境中分析恶意软件，监控其活动及子进程，以确定恶意软件的性质和目的。它能够确定恶意软件的进程活动、与文件系统和网络的交互，同时执行内存分析并存储分析后的人工制品以备后续分析。 使用 Limon 分析 Linux 恶意软件...

MalwareSourceCode

managed by vx-underground | follow us on Twitter | download malware samples at the VXUG/samples page 免責事項： 適用される法律で許容される最大限の範囲において、vx-underground およびコンテンツを vx-underground に提出した関連会社は、間接的、偶発的、特別、結果的、懲罰的損害賠償、または直接間接を問わず発生した利益や収入の損失、データ、使用、のれん、その他の無形資産の損失について、以下の事由に起因する場合、一切の責任を負いません。i...

linux-malware-detect

Linux Malware Detect LMD Malware scanner for Linux — multi-stage threat detection MD5, SHA-256, HEX, YARA, statistical analysis, ClamAV integration, real-time inotify monitoring, quarantine/clean/restore operations, and multi-channel alerting email, Slack, Telegram, Discord. C 2002-2026, R-fx...

linux-malware-detect

Linux Malware Detect LMD Linux 恶意软件扫描器 — 多阶段威胁检测（MD5、SHA-256、HEX、YARA、统计分析），ClamAV 集成，实时 inotify 监控，隔离/清除/恢复操作，以及多渠道告警（电子邮件、Slack、Telegram、Discord）。 C 2002-2026, R-fx Networks C 2026, Ryan MacDonald 依据 GNU GPL v2 许可 2.0.1 新特性 原生扫描引擎提速 43 倍 — 原生扫描流水线已使用批量并行处理完全重写。基于约 10,000 个文件的真实基准测试： 版本| 运行时间| 文...

yara-rules

yara-rules 基于近期恶意软件研究收集的YARA签名集合 规则集 Dacls木马 规则: DaclsLinux.yara 规则: DaclsWindows.yara 参考: https://blog.netlab.360.com/dacls-the-dual-platform-rat/ APT32 KerrDown 规则: APT32KerrDown.yara 参考: https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/ ACBackdoor - Linux构建版本 规则:...

Showboat Linux Malware Hits Middle East Telecom with SOCKS5 Proxy Backdoor

Cybersecurity researchers have disclosed details of a new Linux malware dubbed Showboat that has been put to use in a campaign targeting a telecommunications provider in the Middle East since at least mid-2022. "Showboat is a modular post-exploitation framework designed for Linux systems, capable...

linux-malware-toolbox

Linux Malware Samples - Educational Repository ⚠️ IMPORTAN...

linux-malwares

Linux Malware Samples - Educational Repository ⚠️ IMPORTAN...

VoidLink Linux Malware Framework Built with AI Assistance Reaches 88,000 Lines of Code

The recently discovered sophisticated Linux malware framework known as VoidLink is assessed to have been developed by a single person with assistance from an artificial intelligence AI model. That's according to new findings from Check Point Research, which identified operational security blunder...

New China Linked VoidLink Linux Malware Targets Major Cloud Providers

Researchers have discovered VoidLink, a sophisticated new Linux malware framework designed to infiltrate AWS, Google Cloud, and Azure. Learn how this Chinese-affiliated toolkit uses adaptive stealth to stay hidden...

New Advanced Linux VoidLink Malware Targets Cloud and container Environments

Cybersecurity researchers have disclosed details of a previously undocumented and feature-rich malware framework codenamed VoidLink that's specifically designed for long-term, stealthy access to Linux-based cloud environments According to a new report from Check Point Research, the cloud-native...

China-Linked UAT-7290 Targets Telecoms with Linux Malware and ORB Nodes

A China-nexus threat actor known as UAT-7290 has been attributed to espionage-focused intrusions against entities in South Asia and Southeastern Europe. The activity cluster, which has been active since at least 2022, primarily focuses on extensive technical reconnaissance of target organizations...

ThreatsDay Bulletin: Wi-Fi Hack, npm Worm, DeFi Theft, Phishing Blasts— and 15 More Stories

Think your Wi-Fi is safe? Your coding tools? Or even your favorite financial apps? This week proves again how hackers, companies, and governments are all locked in a nonstop race to outsmart each other. Here's a quick rundown of the latest cyber stories that show how fast the game keeps changing...

APT36 Targets Indian Government with Golang-Based DeskRAT Malware Campaign

A Pakistan-nexus threat actor has been observed targeting Indian government entities as part of spear-phishing attacks designed to deliver a Golang-based malware known as DeskRAT. The activity, observed in August and September 2025 by Sekoia, has been attributed to Transparent Tribe aka APT36, a...

EUVD-2025-13634

Malicious code in bioql PyPI...

CHILLYHELL macOS Backdoor and ZynorRAT RAT Threaten macOS, Windows, and Linux Systems

Cybersecurity researchers have discovered two new malware families, including a modular Apple macOS backdoor called CHILLYHELL and a Go-based remote access trojan RAT named ZynorRAT that can target both Windows and Linux systems. According to an analysis from Jamf Threat Labs, ChillyHell is writt...

Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection

Cybersecurity researchers have shed light on a novel attack chain that employs phishing emails to deliver an open-source backdoor called VShell. The "Linux-specific malware infection chain that starts with a spam email with a malicious RAR archive file," Trellix researcher Sagar Bade said in a...