1337_GTWK Linux Malware Analysis

4 min read

4 days ago

This is the second part of a two-part series about a new Linux malware sample that I analysed (Click here for Part 1). In Part 1, we examined its website and the malware’

itself.

The malware consists of two stages, with the second stage comprising two separate components. The first stage is a shell script that downloads and installs a Linux kernel module.

Please note that the complete infection chain is currently unknown, as I have not yet determined how the initial infection occurs.

First Stage: Shell Script

The first Stage

This file is the first known component in the infection chain. Th…