https://blog.efespain.com/en/tags/static-analysis/A honeypot in some corner of the network. Every infection, a story worth telling.HugoeneFeSpaineFeSpain2026 eFeSpainTue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-24/Tue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-24/The previous chapter left a number unexplained: the backdoor was deleting a different process on every installation, and that can't be known in advance. I open the miner and the answer shows up — a template with the gap already reserved. Along the way out comes the wallet the money goes to, behind encryption that's frankly laughable.https://blog.efespain.com/en/chapter-2/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-2/In Chapter 1 the C2 stayed encrypted inside the binary. Here I open it with Ghidra and it comes out whole — but on the way, everything else this critter carries turns up too: how it disguises itself as a system process, how it kills the competition using the very trail that gives it away, and how it lies about its own address when its command centre tells it to.https://blog.efespain.com/en/chapter-1/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-1/I keep a honeypot in some corner of the network. Most of it is noise: scanners that look and leave. Until one got in, decided it was the administrator, and pushed its critter up through the service door.https://blog.efespain.com/en/chapter-3/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-3/Another one walks in and drops its critter. But this one left a door open on its own delivery server — and inside was the source code. A multi-architecture Mirai, caught red-handed.