https://blog.efespain.com/en/A honeypot in some corner of the network. Every infection, a story worth telling.HugoeneFeSpaineFeSpain2026 eFeSpainTue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-28/Tue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-28/The two previous chapters left the kit taken apart piece by piece, and one question unanswered: who it pays. I went looking. And what I found was a design that prevents it — the mining config never travels inside the critter, it gets downloaded afterwards — and scaffolding somebody had already dismantled. This is the chase, what it does plant when you let it run, and how far what I can prove about who's behind it actually goes.https://blog.efespain.com/en/chapter-27/Tue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-27/The kit sat still on the disk, so I switched it on myself in a cage with no way out. Inside there's a bot that insists on knowing its own address before anything else, joins a mesh of up to two thousand nodes, holds an election and crowns itself leader — and only then opens a Telegram chat. The operator never logs into any machine: he sends a message to the head of the pack. And when you burn the chat, the botnet heals itself.https://blog.efespain.com/en/chapter-26/Tue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-26/The family from the previous chapter didn't stand still: there's a newer build going around, and I caught it from the first second. It brute-forces its way in over SSH, sizes the machine up, evicts the competition —its own older version included—, uploads sixteen megabytes in a single file and fires. All in a little over a minute. And then it walks straight into one line of fstab.https://blog.efespain.com/en/chapter-25/Tue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-25/The teardown left me a Monero wallet and a question the binary doesn't answer: how much has this thing earned. Monero is built so no balance can be looked up — but the pool they mine against publishes per-wallet statistics, and that's an open page. What turned up when I asked: one wallet collecting since January 2021, another already running months before it showed up in any sample, about twenty-three dollars a day, and an electricity bill paid by the victims that comes to more than the operator makes.https://blog.efespain.com/en/chapter-24/Tue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-24/The previous chapter left a number unexplained: the backdoor was deleting a different process on every installation, and that can't be known in advance. I open the miner and the answer shows up — a template with the gap already reserved. Along the way out comes the wallet the money goes to, behind encryption that's frankly laughable.https://blog.efespain.com/en/chapter-23/Tue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-23/I left a password sitting on a decoy and, one Sunday, something came through it three times. I neutralised what it brought; what I didn't see until later was what it left planted — a line in .bashrc that makes «top» lie and hide the very process eating the machine. A rootkit without a rootkit. And putting two frozen disks side by side turned up the detail that changes everything: the same line, with a different number.https://blog.efespain.com/en/chapter-22/Tue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-22/A bot of the Mirai school carries the address of whoever gives it orders. I looked for this one's by four different routes and found it by none — and along the way I published a theory of my own that turned out to be false. What finally worked wasn't a better tool: it was realising that somewhere out there sat another binary, compiled from the same code, whose command centre somebody had already published. With both in front of me, the difference between them is one thousand one hundred and thirty bytes.https://blog.efespain.com/en/chapter-21/Tue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-21/An automated scanner found the honeypot's telnet and, eighteen seconds later, there was a binary inside. The password was «telnet». The loader it dropped comes with two operator typos, one of which breaks an entire infection. And when I finally put a name to the family —IranBot, a Mirai fork with a public dossier— it turned out that name had been written on this blog since August: a rival bot had put it there, in the list of competitors it uninstalls on arrival.https://blog.efespain.com/en/chapter-20/Tue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-20/The previous chapter left a question the binary doesn't answer: of the thirteen STUN servers Cling beacons to, one has to be the operator's mailbox —because the bot announces its ports only to those thirteen, to nobody else— and yet all thirteen look like innocent VoIP providers. I didn't catch it issuing an order; I found it by elimination and exclusivity, using public records to see who talks to each one. Twelve have an alibi. The thirteenth doesn't.https://blog.efespain.com/en/chapter-19/Tue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-19/I pulled down the three binaries from the previous chapter expecting the usual DDoS arsenal. It wasn't there: not one attack function. What it does instead —and above all, the channel its orders arrive on— is the strangest thing that has come through the honeypot. A bug designed, top to bottom, not to be seen.https://blog.efespain.com/en/chapter-18/Tue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-18/An already-infected IP connected to the honeypot's telnet and pasted a recipe all at once: eleven binaries, one per architecture, each with a made-up name that will never come round again. Two weighed exactly the same and looked like variants — they turned out to be the i586 and i686 builds of the same program. And behind them wasn't a stray bug: fifty-odd distinct binaries in two weeks. The whole delivery is built so that no blocklist, by name or by signature, catches anything.https://blog.efespain.com/en/chapter-17/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-17/A quiet Sunday, my new-binary alarm went off after days of silence. The first thought was the best one there is: something fresh. What followed was a rollercoaster — an old acquaintance, a false positive that nearly fooled me, and finally a critter that wasn't in any public repository, caught less than thirty hours after it was born.https://blog.efespain.com/en/chapter-16/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-16/A bot walked into my honeypot, stayed 62 seconds and left. I filed it as Gafgyt and I was wrong. A week later I followed its command servers and ended up inside an operation that has been running since 2015 — one I'd had in my hands from day one.https://blog.efespain.com/en/chapter-15/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-15/I built a cage, ran the miner and pulled from memory the configuration I couldn't decrypt back in chapter 6. I got excited… and walked away with two things I wasn't looking for: that this family was already documented top to bottom —somewhere it never occurred to me to look— and that the piece I thought I'd decrypted was for something else.https://blog.efespain.com/en/chapter-14/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-14/In chapter 9 someone tried to make my phone switch pay for their calls. I wrote it up and closed the incident, with one question left hanging: who was on the other end? This time I didn't just watch through the window. I gave the decoy a memory, followed the number's trail, and found out why they pick exactly those numbers.https://blog.efespain.com/en/chapter-13/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-13/In chapter 10 I caught the miner, but not the thing that hands it out: that part I told on loan, using someone else's analysis. The honeypot holds a grudge, and brought me the whole thing — armoured three times over, with a blob that resisted everything I know how to do. Until I stopped trying to read it.https://blog.efespain.com/en/chapter-12/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-12/The binary arrived unstripped: its author left inside the names of all six hundred and twenty-eight functions he wrote. It is like being handed a closed book with the index stapled to the cover. Here I read it end to end, function by function, until I reach the one string that fitted nowhere.https://blog.efespain.com/en/chapter-11/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-11/A 1,177-byte loader landed: nine lines of wget, one per architecture, in the style I have already opened three times on this blog. I was going to file it as a repeat offender and get on with my day. I opened it anyway, out of habit — and the first thing I saw was that it had a few characters too many.https://blog.efespain.com/en/chapter-10/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-10/Another APK came in through the debug cable, but this one weighs fifteen times less than the last and doesn't carry a single line of native code. I opened it expecting something mediocre. What I found was a 2018 fossil still infecting phones to mine for a company that shut down seven years ago — and which today, without knowing it, warns its own victims.https://blog.efespain.com/en/chapter-9/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-9/This time no binary landed. A fraud did: for two hours, fifteen machines tried to make my PBX place 3,457 international calls — the trial run of an International Revenue Share Fraud (IRSF), with the bill in my name. A chapter with no Ghidra: just protocol, money and OSINT.https://blog.efespain.com/en/chapter-8/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-8/We peel the APK apart layer by layer: a DEX that's nothing but a launcher, an app that nails itself into /system if there's root, and a native DDoS engine. The C2 slammed the door in my face — until I came back another way and it opened.https://blog.efespain.com/en/chapter-7/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-7/The previous three went after servers. This one went after a phone: it came in through ADB, wiped out the competition, installed its app disguised as Google, and hid itself. First Android malware in the honeypot.https://blog.efespain.com/en/chapter-6/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-6/We unpack RedTail's miner and crack it open in Ghidra hunting for the pool and the wallet. What we find is more interesting than a number: the data is in there, embedded and encrypted — and nobody has published how to crack it.https://blog.efespain.com/en/chapter-5/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-5/The previous critter kicked the door in with wget. This one walked in with an SSH key in its pocket, cleared the house of rival miners, and settled in with a professional's manners. It's RedTail, and it plays in a different league.https://blog.efespain.com/en/chapter-4/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-4/The bot from the last chapter kept its config encrypted and its orders under lock and key. Ghidra spills the lot: the decryption (a laughable XOR), the botnet's real name, its C2 protocol and its full arsenal — without handing out weapons.https://blog.efespain.com/en/chapter-3/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-3/Another one walks in and drops its critter. But this one left a door open on its own delivery server — and inside was the source code. A multi-architecture Mirai, caught red-handed.https://blog.efespain.com/en/chapter-2/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-2/In Chapter 1 the C2 stayed encrypted inside the binary. Here I open it with Ghidra and it comes out whole — but on the way, everything else this critter carries turns up too: how it disguises itself as a system process, how it kills the competition using the very trail that gives it away, and how it lies about its own address when its command centre tells it to.https://blog.efespain.com/en/chapter-1/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-1/I keep a honeypot in some corner of the network. Most of it is noise: scanners that look and leave. Until one got in, decided it was the administrator, and pushed its critter up through the service door.https://blog.efespain.com/en/iocs/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/iocs/Everything worth searching for: hashes, addresses, domains, keys and strings from every specimen that has landed in the honeypot, with the chapter that explains where each one comes from.https://blog.efespain.com/en/ethics/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/ethics/The fixed rules of this diary: what gets analyzed, what gets published, what stays quiet, and why.https://blog.efespain.com/en/glosario/Mon, 01 Jan 0001 12:00:00 +0000https://blog.efespain.com/en/glosario/The technical words of the diary, explained in plain language. Because knowledge shouldn't be for the few.https://blog.efespain.com/en/pulso/Mon, 01 Jan 0001 12:00:00 +0000https://blog.efespain.com/en/pulso/