Yet please feel free to use these information freely for your mitigation work or extract IOC to prevent these infection gone worst, or for research purpose. The intelligence for this information can not be disclosed further for the security purpose, the data belongs to the MalwareMustDie, NPO (thank you to a hard work for ELF Team team mate) bound to our disclaimer. (Pic = A spreader's attack log of an ELF botnet infection) The IOC generation or blocking rules based on this list is highly recommendable. Nonetheless, those are bad hosts that either should be blocked before it gets a take-down, or to be cleaned up. In the bottom of this post there is a list of IP addresses which are infector hosts, that was recorded in the early 2016 only, those are: (1) The nodes from 'grey' hoster hired by DDOS skiddies to spread these ELF which are mostly offered in some hacking forums, (2) Hacked server/routers/IoT/VPS that is being used to spread these ELF malware. Some recent ELF compiled binary were coded with a slight obfuscation or with poorly 'crypted' effort (obviously because the actors are kids and lacking of knowledge and experience because they are skipping school so much and too lazy to learn), even the toughest crypted one are so crackable and you can figure it easily using the source code pattern I shared. Our intelligence 'snagged' the source codes that we share and reported to the antivirus and security industry in the previous MalwareMustDie blog post. This post is a collection of information for the infection of the ELF & Perl malware botnet that is being used for DDoS activity. Then you hack internet boxes for whatever purpose, it is a crime,ĭon't do the crime, if you can't do the time. Have some fun when you're young, it's all fair with consequentiality.īut you build malware to do vandalism, you cross the line,

Have your own idea, bring your dreams into reality. backdoor, syn flood, ack flood, ntp flood, udp flood, dns amp, xmas attack, pan flood, x00, cback, LiGhT, Proxseas, BLJ, KaitenBot, fairy, Alex, vanity, Code, Palkia, shenron, GoHack, triple6, 666 Tag: kaiten, ktx, tsunami, STD, stdbot, torlus, Qbot, gayfgt, lizard, lizkebab, antichrist, sinden, sdn, $dn, bossaline, bossabot, dtool, aidra, lightaidra, zendran, styx, Code, Robert, cod, unixcod, styxcod, irc, ircbot, ddos, elfbot, ddoser, nix, elf, linux, unix.

Mmd elf base