Tag
Dynamic analysis
all chapters
- Chapter 15 I went back for RedTail, and RedTail already had an owner I built a cage, ran the miner and pulled from memory the configuration I couldn't decrypt back in chapter 6. I got excited… and walked away with two things I wasn't looking for: that this family was already documented top to bottom (somewhere it never occurred to me to look) and that the piece I thought I'd decrypted was for something else.
- Chapter 27 Only the leader talks The kit sat still on the disk, so I switched it on myself in a cage with no way out. Inside there's a bot that insists on knowing its own address before anything else, joins a mesh of up to two thousand nodes, holds an election and crowns itself leader - and only then opens a Telegram chat. The operator never logs into any machine: he sends a message to the head of the pack. And when you burn the chat, the botnet heals itself.
- Chapter 29 It told me its name three times Another IoT ELF with the look of a run-of-the-mill Mirai landed in the decoy. I christened it “zbot” after its cron files, and it turned out that wasn’t even its name: by three separate routes (the paths it left on disk, the banners it speaks SSH and HTTP with, and the first bytes of every message to its C2) the thing kept telling me its real name. Behind it was something more interesting than a server-flooding bot: a machine for renting out its victim’s home line as a proxy. And an operator who, with the whole thing built, kept breaking his own download URLs. XLab had already named it “Shemzbot” in a tweet; this is the teardown that tweet didn’t carry.
- Chapter 32 It encrypted a broken message too Three lying bytes keep the decompiler out, and behind them there's a second wall: the author's strings aren't in the file at all. By the time I finally got it talking, it had spent a while saying yes to seven orders that don't exist.
- Chapter 33 DIICOT: Ciocolata flavour Almost three megabytes that do one single thing: call home, say two words and wait ten seconds for someone to answer. If nobody does, it leaves without a trace. But inside, encrypted a different way, it carries a second address: a domain nobody has registered. And the rest of the program fits in one line of shell.