Malware-Analysis

Static analysis of a Go-based Linux RAT (Warp/Wraith family, SHA256: 3bfc4394…) that manipulates its ELF structure to evade analysis tools. Three structural anomalies — section header table past EOF, oversized PT_LOAD segment, and dynamic linking on a Go binary — produce an immediate malicious verdict before any disassembly runs. String analysis identifies SSH/SFTP credential harvesting, /bin/systemd-worker process masquerading, and a related 736KB variant (e097c852…) with embedded coinminer payload. Detected via static ELF header inspection alone, no sandbox required.

C and Rust binaries carry compiler fingerprints that cannot be removed: GCC function prologues, LLVM unwind tables, CRT startup code, stack canary patterns, .eh_frame sections. Pure assembly has none of these. Empirical test on live x64 C2 implant: 0/65 static detections on VirusTotal, SROP kernel-mediated execution and process_vm_writev (syscall 311) invisible to behavioral sandbox, only entry-phase ptrace caught. CMOV branch-free execution collapses CFG to a single basic block — confirmed effective by SEBD 2019 academic research.

LockBit 5.0 Linux encrypts files with ChaCha20+Curve25519 with zero network activity — the public key is embedded at compile time. strace attachment triggers immediate termination. Free space is actively wiped post-encryption to prevent carving. Full analysis pipeline: eBPF syscall tracing, Ghidra static RE of crypto routines, pcap-confirmed network behavior, and extracted IOCs including file markers, dropped ransom note paths, and encryption extension patterns.