Glossary

ADB: ADB (Android Debug Bridge) is the tool a developer uses to drive an Android phone or tablet from their computer: installing apps, running commands, poking around inside. It's extremely powerful and asks for no password, so if a device leaves it open to the outside —which happens on set-top boxes and cheap Android gadgets— anyone can push malware onto it. It's the door Sysorbit and Trinity come through.
angr: angr is a binary-analysis tool that, instead of reading the code instruction by instruction, explores it automatically: it mathematically tries every path the program could take to, for example, find which input unlocks a branch or reverses an encryption. This is symbolic execution, and it's a shortcut for when reverse engineering by hand gets steep. It shows up when a sample resists direct analysis.
APK: An APK is the package an Android application ships in: inside are the code, the resources and the permissions it requests. Installing an app means opening its APK. Android malware arrives as an APK someone pushes onto the device (over ADB, for instance), and analysing it means taking that package apart layer by layer. Sysorbit and Trinity's miner are APKs.
argon2: argon2 won the 2015 competition to find the best way to store passwords, and its trick is that it can be tuned to consume a lot of memory: that makes trying millions of keys by brute force enormously expensive. From there it jumped to mining, where the goal is exactly the same — to make building specialised machines not worth it — and several small coins use it under names of their own. That is why it shows up in a malware miner's list of algorithms alongside RandomX and CryptoNight.
ASN: The internet isn't one network but thousands that talk to each other. Each one — a carrier, a hosting provider, a university — has a unique identifier: its ASN (Autonomous System Number). When you see an IP attacking, looking up its ASN tells you which organisation the address belongs to (say OVH, or MEVSPACE). It isn't the attacker, but it is the landlord of the flat they're attacking from — and that's already a thread to pull.

BGP: BGP (Border Gateway Protocol) is the running conversation between the networks that make up the internet: each one announces to the rest which blocks of addresses it can reach, and together they compose the map traffic travels by. For an investigation it has a virtue almost nothing else does: those announcements are archived, so you can ask who was announcing a given range on a given date. Ordinary internet registries only answer for today's state, and mistaking the current owner for the one from three years ago is one of the easiest and quietest errors you can make.
blob: A blob (from «binary large object») is an opaque piece of data: a mass of bytes with no apparent structure that even the tools can't identify. In malware analysis it's often both the juiciest and the hardest part: the encrypted payload, a compressed container, the hidden config. Working out what a blob is —and how it opens— is frequently the knot of the chapter, like Trinity's triply-armoured blob in chapter 13.
booter: A booter (or «stresser») is DDoS as a service: a web panel where you pay —sometimes just a few euros— and order an attack against an address for a few minutes. They advertise themselves with the euphemism of testing «your own network's resilience», but the real business is kicking someone off the internet: a rival in a game, a competing shop, someone you want silenced. Behind a booter there's a botnet supplying the firepower, which is why DDoS malware and these services are two sides of the same business.
botnet: A botnet is a network of infected computers, routers, cameras or phones that obey a single attacker without their owners knowing. Each device is a «bot»; together they're an army steered from a central server. They're used to knock websites offline with floods of traffic (DDoS), mine cryptocurrency, or hide the origin of other attacks. XorDDoS and Mirai, from the early chapters, are botnet families.

C2: C2 (command-and-control) is the attacker's command post: the server the infected critter connects to for instructions, updates, and to hand over what it steals. Finding where a piece of malware calls home — its C2 — is half the case solved: it reveals the attacker's infrastructure and lets you cut off its head. Much of the reverse engineering in this diary is about uncovering the C2 hidden inside the binary.
Certificate Transparency (CT): Since 2018 browsers only accept an HTTPS certificate if it appears in a set of public, append-only records: the Certificate Transparency logs. They were invented to catch fraudulently issued certificates, but they have a side effect that's very useful for investigation: every time someone brings a domain online with HTTPS — even automatically, as Cloudflare does — a dated entry appears that the domain owner neither controls nor can delete. It's somebody else's clock. Careful which date you read: a certificate's "not_before" field is usually backdated by the authority to absorb clock skew; the honest "this appeared in public" time is the log entry's.
ChaCha20: ChaCha20 is a stream cipher: from a key it generates a torrent of bytes and mixes them with the text. It is fast in pure software, with no special processor instructions, which is why it is used in TLS and on phones. It gives itself away: every implementation carries the string expand 32-byte k, which is part of how it starts up. When it turns up inside a specimen it means whoever wrote it has left the home-made XOR behind and brought in real cryptography — bad news for anyone wanting to read its configuration.
Coinhive: Coinhive was a service that let you mine Monero right in the browser of a website's visitors — meant as an alternative to ads, it ended up wildly abused for mining without consent. It shut down in 2019. The curious thing, in chapter 10, is that Trinity's miner still tries to call a Coinhive that no longer exists: a fossil that betrays the critter's age and lineage.
cryptojacking: Cryptojacking is parasitic mining: instead of buying hardware and paying for electricity, the attacker drops a miner onto other people's machines and puts them to work generating cryptocurrency for them. The victim notices, at most, that their device is slow or drawing more power. It's the business of families like RedTail and Trinity, which the moment they get in set your server mining Monero.
CryptoNight: CryptoNight was Monero's mining algorithm until 2019, and that of a good many of the cryptocurrencies born in its shadow. It is designed to lean heavily on memory, which at the time made building dedicated hardware expensive. Monero swapped it for RandomX, but it hasn't gone away: the miners that circulate inside malware ship with a dozen-odd of its variants as standard, because the same binary will mine different coins depending on what its configuration tells it.

DDoS: A DDoS (distributed denial of service) doesn't steal or break in: it simply drowns. A botnet of thousands of devices throws traffic at a website or server all at once, until it runs out of resources and stops serving legitimate users. It's the specialty of Mirai- or Gafgyt-type families: turning other people's cameras and routers into a battering ram.
default credentials: Many devices —cameras, routers, recorders— ship with default credentials, identical across every unit of the model and printed in the manual. If the owner doesn't change them, anyone who knows that combination walks right in. That's exactly what IoT botnets exploit: trying the most common factory credentials against millions of devices. XorDDoS, in chapter 1, gets in precisely this way.
DoT (DNS over TLS): A DNS query —turning a domain name into its IP— normally travels in the clear: your provider, the firewall or anyone watching the network sees which domains you ask for. DNS over TLS (DoT) wraps that query in an encrypted tunnel, on port 853, so the destination and port are visible but the content isn't. Plenty of people use it for legitimate privacy; it also lets malware hide which domains its infrastructure resolves.
dropper: A dropper is the advance party. It's usually a script or a tiny binary whose only job is to prepare the ground —check the machine's architecture, find a directory it can write to, disable defences— and then fetch the main program from a server and run it. They're kept separate on purpose: the dropper is cheap to rebuild, so its name and hash are changed on every delivery to make blocklists useless, while the real payload stays put. When the downloader is a somewhat more elaborate stage, it's usually called a loader instead.

ELF: A binary is a program in its final form, translated into instructions the processor understands directly — unreadable to a person without tools. On Linux systems (and in almost all the malware in this diary) that file follows the ELF format. When an attacker drops their critter, what arrives is an ELF binary; opening and understanding it is the work of the reverse-engineering chapters.
entropy: Entropy measures how close data is to pure randomness. Normal text has low entropy (patterns, repetition); something encrypted or compressed has high entropy (structureless noise). In reverse engineering it's a compass: sweeping a binary's entropy, a spike betrays where something is hidden —a key, an encrypted block, a table. In the RedTail chapters, a fine entropy sweep uncovers a table hidden among the data.

fork: A fork is what happens when someone takes a program's source code and starts changing it on their own, never merging back. In malware it's the norm: when Mirai's source leaked in 2016, anyone could compile their own, strip out what they didn't need and bolt on whatever they wanted. That's why dozens of families share the same skeleton underneath. And it's why saying "it's a Mirai fork" describes where the code came from — not who operates it.

Ghidra: Ghidra is a reverse-engineering tool: it takes a compiled binary —the ones and zeros a machine understands but a person can't— and translates it into something readable, so you can follow what it does instruction by instruction. It was released by the US NSA and it's free. In this diary it's the dissection table: it's how the encryption, the C2 and the real purpose of each sample get uncovered.

honeypot: A honeypot is a trap. It pretends to be a real, vulnerable server, phone or device, but holds nothing important: it exists so attackers find it and hit it while you watch. Everything an intruder does inside is logged, and since no legitimate user has any reason to touch it, any activity is by definition suspicious. It's the source of almost everything in this diary.

INVITE: INVITE is the SIP message that starts a call: "from this extension, dial this number". In legitimate hands it sets up your everyday call. In the hands of an IRSF fraudster, it's the tool that — once inside a phone switch — makes it dial their premium numbers thousands of times. In the diary, a flood of INVITEs to the same number is the signature of an attack in progress.
IOC: An IOC (Indicator of Compromise) is a concrete technical clue that betrays a threat: the IP of a command server, the domain a piece of malware calls, the hash of a malicious file. Publishing them lets others search their own networks and detect or block the same thing. Every chapter ends with its IOC table for exactly that reason: so the finding is useful beyond this one decoy.
IoT: IoT (Internet of Things) is the whole swarm of connected devices that aren't computers or phones: security cameras, routers, TVs, plugs, recorders. They tend to be cheap, never updated and shipped with factory passwords — the perfect target for botnets, which infect them by the million to build their attacks. The families in the early chapters live off this.
IRSF: IRSF (International Revenue Share Fraud) is phone fraud. Some numbers share money: every time they're called, the carrier pays a cut to whoever controls the number. The fraudster rents one of those numbers and, to pay themselves, needs to generate calls to it en masse. How? By finding misconfigured phone switches belonging to others and tricking them into placing the calls — so the bill lands on the owner. It's the engine of chapters 9 and 14.

jadx: jadx is an Android decompiler: it takes an APK (which inside is bytecode the machine understands and a person doesn't) and reconstructs it into something like the original, readable Java. It's the Ghidra of the Android world: it's what opens Sysorbit and Trinity's miner to see what they request, where they call, and how they hide. It doesn't always come out clean —malware obfuscates— but it's the starting point.

loader: A loader (or dropper) is the advance party: a lightweight program that, once inside, fetches and runs the real payload —the miner, the bot, whatever it is. It's often the first thing to land in the trap. Loaders change shape constantly (their hash varies with each download) to dodge blocklists, so recognising them by hash is useless: you catch them by their behaviour or by the C2 they call.

MalwareBazaar: MalwareBazaar, run by the abuse.ch project, is an open store of malware samples. Whoever catches a binary uploads it with its hash, its family and its tags, and from then on antivirus vendors, response teams and any researcher can reach it. Its value is twofold: it tells you whether something is already known — if the hash isn't there, either nobody has seen it or it has just been born — and it keeps what you catch from dying in your own lab. It's where this diary's samples end up.
Mersenne Twister (MT19937): The Mersenne Twister (its classic version, MT19937) is a pseudo-random number generator: starting from an initial number —the seed— it produces a stream of bytes that looks random but is deterministic, always the same for the same seed. It isn't cryptographically secure, but as an improvised key it's convenient: if you encrypt by applying that sequence byte by byte with XOR, anyone who knows the seed reproduces it and decrypts. It's recognised by a characteristic constant at start-up, 0x6c078965.
miner: A miner (or cryptominer) is the software that produces cryptocurrency by solving mathematical problems relentlessly, a job that devours CPU and electricity. In an attacker's hands it's the payload of cryptojacking: it installs on the compromised machine and mines tirelessly for the intruder's wallet. XMRig is the most common Monero miner in these pages.
Monero: Monero is a cryptocurrency like Bitcoin, but with one key difference: it's designed so transactions are anonymous and impossible to trace on a public chain. That makes it ideal for crime: an attacker's miner generates Monero and nobody can follow where the money goes. Almost all the cryptojacking in this diary —RedTail, Trinity— mines Monero.

nonce: A nonce (number used once) is the key's companion in modern ciphers. The key is secret and long-lived; the nonce changes with every message, and its job is to stop two identical texts producing the same ciphertext — which is precisely the crack that home-made encryption schemes split along. It isn't secret: it can sit in plain view, even written inside the binary itself. But you need it to decrypt, so publishing it is what turns a finding into something somebody else can reproduce.

obfuscation: Obfuscation is the art of hiding in plain sight: the program works the same, but it's written in a deliberately convoluted way so the analyst gets lost. Encrypted strings, functions that take endless detours, names replaced with garbage. Tools like OLLVM do it automatically. In chapter 13, Trinity came obfuscated three times over; much of the work was peeling back those layers.
OLLVM: OLLVM (Obfuscator-LLVM) is a modification of the compiler that, when building a program, deliberately tangles it: it flattens the control flow, adds fake branches, encrypts strings. The result does the same thing but is hell to read. Malware uses it to slow down reverse engineering. In chapter 13, one of Trinity's armour layers is precisely OLLVM, and undoing it was part of the work.
OSINT: OSINT (Open Source Intelligence) is drawing conclusions from information that's already public: records of who owns an IP or a number, search engines, third-party databases, official listings. The key — and the ethical line of this diary — is that it's passive: you look up what's open, you never probe or attack the other side's infrastructure. Everything learned here about the attackers is learned this way.

Passive DNS: Ordinary DNS only answers about the present: «what IP does this domain resolve to now?». Passive DNS is a set of collections that store those answers over time, gathered by sensors spread across the network. That gives you two things plain DNS can't: a domain's history —which addresses it passed through, and when— and the reverse lookup, asking an IP which names have pointed at it. For following infrastructure it's the central tool: it's done from outside, without touching anyone else's machine, and it's what turns «this IP looks suspicious» into «these domains lived here, on these dates».
Pearson hash: The Pearson scheme uses a 256-byte table —a permutation of every possible value— to transform data: each output byte is T[h ⊕ c], where h carries the previous result forward. It's a chained substitution, cheap and non-cryptographic, typical of fast hashes and obfuscation. It differs from RC4 —which also carries a 256-byte table— in that Pearson only reads the table, whereas RC4 rewrites it (a swap) on every output byte.
pool: A mining pool is a co-op: since mining alone almost never hits a reward, many miners combine their power in a pool, solve together, and share what they earn according to what each contributes. Cryptojacking malware usually points its miner at a public pool (or its own), and seeing which pool and which wallet it connects to is what reveals where the stolen money goes.
proxy exit node: A proxy exit node is a server that rents out (or is forced to lend) its internet connection so other people's traffic reaches the network disguised as it. It's used to hide the real origin: whoever uses it shows up with the node's IP, not their own. You spot one because a single machine has thousands of open ports, which doesn't fit a normal server. In chapter 14, the machines pumping the most fraudulent calls turn out to double as exit nodes — one server, two dirty businesses stacked on top of each other.
proxyjacking: Proxyjacking is parasitic fraud: an attacker breaks into someone else's machine and, without the owner noticing, enrols it in a service that resells its bandwidth as a proxy. The intruder gets paid for other people's traffic flowing through that connection, while the victim pays the internet bill and carries whatever others do through their IP. It's a cousin of stealth cryptomining, but instead of stealing CPU it steals connectivity. In chapter 14 it's distinguished from a purpose-built exit node: proxyjacking is when the machine is a hijacked victim, not one the fraudster rents themselves.

qemu: qemu is a machine emulator: it pretends to be a processor other than yours so it can run binaries compiled for other architectures —a phone's ARM, an IoT gadget's RISC-V, a router's MIPS— on an ordinary PC. In malware analysis it's invaluable: a lot of what lands in the trap won't run on a desktop x86, and qemu lets you run it in a controlled environment to see how it behaves.

RandomX: RandomX is the algorithm Monero is mined with. It's deliberately built to run well on ordinary CPUs and badly on the specialised hardware (ASICs) that dominates other cryptocurrencies. The side effect: any computer or server will do to mine it, which makes it perfect for cryptojacking — the malware's miner squeezes the victim's processor precisely because RandomX is made for that.
RDAP / WHOIS: Every domain and every block of addresses is recorded in a public registry. WHOIS is the classic query system and RDAP its modern version, the one returning structured data. It's how you learn when a domain was registered, who holds a range of IPs, which organisation a network number belongs to and which abuse mailbox answers for it. With domains there's a limit: since GDPR nearly all personal data is redacted, so WHOIS no longer says who registered what. With IPs and ASNs, though, it's still a goldmine: there the holders are organisations, and they come with a name and a date.
REGISTER: REGISTER is how a SIP device signs on to a phone switch: "I'm extension so-and-so, here I am". It's legitimate and necessary. But an attacker turns it into brute force: sending thousands of REGISTERs trying extension numbers (200, 201, 1001…) until one exists and asks for no password. It's the telephone equivalent of trying every doorknob.
reverse engineering: Reverse engineering is the art of going backwards: starting from a finished product —here, malware you only have the executable for— and reconstructing what it does and how, with no manual or source code. It's what happens in the «with Ghidra» chapters: open the binary, decrypt its secrets and lay out its mechanism. It takes patience and method, and sometimes you hit a wall.

SHA-256: A hash is a fingerprint: you run a file through a mathematical function and out comes a fixed-length code (SHA-256, for instance, is always 64 characters) that identifies that exact file. Change a single bit and the hash is completely different. It lets you recognise a malware sample without distributing it: you share its hash, not the binary. That's why each chapter's IOC table carries the sample's SHA-256.
Shodan: Shodan is like a Google for machines: instead of web pages, it scans the internet and catalogues connected devices and the services they expose —which ports are open, which software version they run. Researchers use it to size up a problem (how many vulnerable devices are out there); attackers, to find victims. In chapter 13 Shodan is cited to estimate how many devices were exposed to Trinity.
sinkhole: A sinkhole is a diversion: somebody — a CERT, a security company, sometimes the police — takes over the domain a botnet was using and points it at a server of their own. From then on every infected machine that calls home gets counted, and the orders it was expecting never arrive. Sometimes all it takes is paying for a domain the operator let lapse. You can spot them because they answer everything, on hundreds of ports, and do nothing with what they receive: they are there to listen, not to reply.
SIP: SIP (Session Initiation Protocol) is the standard protocol of internet telephony. It doesn't carry the voice itself; it handles the choreography: starting a call, ringing the other end, negotiating where the audio will flow, and hanging up. When an attacker abuses a phone switch, SIP messages are what they speak: asking to register, asking to call. Reading them is understanding the attack.
SSH: SSH (Secure Shell) is the protocol for logging into a server over an encrypted command line to manage it remotely. It's essential and secure… if the password is strong. When it isn't, it becomes attackers' favourite way in, brute-forcing common usernames and passwords until they slip through. Several of the diary's victims were most likely compromised through an SSH with weak credentials.
strings: strings is a classic Unix utility that walks a file and spits out every printable text string it finds — messages, paths, domains, commands. In malware analysis it's the first move: before opening anything in Ghidra, a quick strings sometimes already shows you the C2, a URL, or a hint of purpose. If the binary is packed or encrypted, strings sees almost nothing — and that silence is information too.
symbols (stripped): When a program is compiled, the binary can keep a table with the original names of its functions and variables. Debuggers use it. Anyone shipping malware always deletes it — the binary is said to be "stripped" — because those names give away at a glance what each piece does and which codebase it came from. An unstripped binary hands you the analysis: instead of an anonymous function at a memory address, you read "attack_tcp_syn". It also weighs noticeably more, so a file that bulks up next to its siblings tends to give itself away.

telnet: Telnet is the grandfather of remote access: it lets you connect to a device over the network, but it sends everything in the clear and survives mostly on old IoT gadgets that still leave it open with the factory password. Botnets like Mirai know this: they scan the internet for open telnet, try «admin/admin» and textbook passwords, and the moment they get in they add the device to their army.
traffic pumping: Traffic pumping (or artificial traffic generation) means steering masses of calls toward numbers that share revenue, to pocket a cut on each one. It's a cousin of IRSF, with a difference of style: classic IRSF aims at exotic, high-tariff destinations; traffic pumping can go against Western numbering that looks perfectly normal, precisely to avoid drawing attention. The money mechanism is the same —earning from the billing chain— what changes is the destination's disguise.
TTL: TTL (Time To Live) is a number each network packet carries, reduced by one for every router it crosses; when it hits zero the packet is dropped (so it can't loop forever). What's interesting to an analyst is its starting value: different operating systems use different initial values (Linux, Windows…), so — discounting the hops along the way — the TTL gives a hint, not a certainty, about the machine you're talking to.

UPX: Packing a binary is wrapping it in a layer that compresses and blurs it: when it runs it unpacks itself in memory, but on disk you can't see its strings or structure. UPX is the most widely used free packer, by both legitimate programs and malware that wants to get in the way of analysis. The first step with many samples is unpacking them so they can be read.
User-Agent: The User-Agent is a text string a client identifies itself with when connecting: what program it is and which version. A browser says "Chrome"; a scanning tool usually says its own name. It's useful for classifying traffic, but anyone can write whatever they want in it — which is why serious attribution never leans on the User-Agent alone. Oddly, almost nobody fakes a scanner's name: that only gives you away.

VirusTotal: VirusTotal is the antivirus industry's shared counter: you hand it a file, or simply its hash, and it returns what each of its seventy-plus engines makes of it, along with the relations it knows about — which addresses it talks to, which servers have served it — and reports from the sandboxes that have already run it. Querying by hash uploads nothing: if the sample is already there, within seconds you know what family it belongs to and how long it has been public. It is the cheapest question you can ask a binary.
VPS: A VPS (Virtual Private Server) is a computer you rent in a provider's data centre, usually for a few euros a month and just a card number. For a hobbyist it's where you run your honeypot; for an attacker, a cheap, near-anonymous, throwaway machine to operate from: when one falls or gets blocked, they spin up another. Almost all the attack infrastructure in this diary lives on VPSs like these — sometimes other people's, compromised, belonging to someone who has no idea their server is in someone else's hands.

XMRig: XMRig is a free, legal program for mining Monero, made for people who want to mine on their own hardware. The trouble is that, being open and effective, it's also the miner that almost all cryptojacking malware stuffs into the machines it compromises. When XMRig shows up in a chapter, it's not that the attacker wrote it: they took it off the shelf and set it mining for themselves.
XOR: XOR is a basic logic operation that, applied byte by byte with a key, scrambles text into gibberish; applied again with the same key, it gives it back untouched. Being cheap and reversible, it's malware's favourite homemade cipher for hiding data it doesn't want to show —its C2 domain, its commands— inside the binary itself. Finding the key and undoing the XOR is a recurring moment in the Ghidra chapters.

YARA: YARA is the standard language for describing «how you recognise this bug». A rule lists concrete markers —a text string, a byte sequence, a constant— and matches a sample when it finds enough of them. It's used to classify files at scale: public repositories run thousands of rules over every sample they receive and name the family that way. Its advantage over a feed's label is that the rule says exactly why: it looks inside the file rather than copying what someone else said.