Анализ вредоносных ELF-файлов Linux

★ 8.4 · security

analyzing-linux-elf-malware is a Claude Code skill that analyzes malicious Linux ELF binaries — botnets (Mirai, Gafgyt, XorDDoS), cryptominers, ransomware, and rootkits targeting Linux servers, Docker containers, Kubernetes pods, and cloud infrastructure. The skill combines static inspection using readelf, objdump, nm, and the pyelftools Python library with dynamic tracing via strace, ltrace, and GDB, plus reverse engineering of x86_64, ARM, and MIPS samples in Ghidra or Radare2. It covers IOC extraction from embedded strings, section entropy analysis to detect packers like UPX, and identification of persistence mechanisms such as crontab, systemd, and ld.so.preload. Use it when triaging a suspicious ELF binary, investigating a compromised Linux server, or examining container-targeted malware.