Anti-Analysis

Static analysis of a Go-based Linux RAT (Warp/Wraith family, SHA256: 3bfc4394…) that manipulates its ELF structure to evade analysis tools. Three structural anomalies — section header table past EOF, oversized PT_LOAD segment, and dynamic linking on a Go binary — produce an immediate malicious verdict before any disassembly runs. String analysis identifies SSH/SFTP credential harvesting, /bin/systemd-worker process masquerading, and a related 736KB variant (e097c852…) with embedded coinminer payload. Detected via static ELF header inspection alone, no sandbox required.

LockBit 5.0 Linux encrypts files with ChaCha20+Curve25519 with zero network activity — the public key is embedded at compile time. strace attachment triggers immediate termination. Free space is actively wiped post-encryption to prevent carving. Full analysis pipeline: eBPF syscall tracing, Ghidra static RE of crypto routines, pcap-confirmed network behavior, and extracted IOCs including file markers, dropped ransom note paths, and encryption extension patterns.