🧪 Malware Analysis Lab – Linux ELF Botnet Analysis

Author: Evans Emmanuel Davou (Weng) Date: August 2026 Target: Linux ELF 32-bit botnet agent (Mirai/Gafgyt family)

---

📌 Overview

This repository contains a complete end-to-end malware analysis lab: a professional report, Indicators of Compromise (IoCs), a YARA detection rule, and automated scripts for static and dynamic analysis.

The lab was built using VirtualBox on macOS, with Kali Linux as the analyst workstation and Ubuntu as the victim machine, using INetSim as a fake internet server.

---

🏗️ Lab Architecture

Host-Only Network (192.168.56.0/24)
│
├── Ubuntu (Victim)          → 192.168.56.101  → Runs the malware
├── Kali (Analyst)           → 192.168.56.102  → Static analysis + Ghidra
└── INetSim (Fake Internet)  → 192.168.56.101  → Intercepts DNS/HTTP/HTTPS

🔒 Fully isolated — no internet access, all malicious traffic stays inside the lab.

---

🎯 Key Findings

Category	Details
Sample Hash	2ae7dc16ca036cb5c2c7ce2cd8099edb07d96b8846188c92eb39a7feba2fec08
File Type	ELF 32-bit LSB executable, statically linked, stripped
Family	Likely Mirai/Gafgyt variant
C2 Domains	cdn-edge-updates.hostcloud-eu.net, anasb3azbi.duckdns.org, api-relay-3.metrics-collector.io
C2 IPs	91.92.40.5:6767, 45.61.161.207:6767
Dropped Files	/tmp/.network-dispatch, /var/tmp/.network-dispatch, /dev/shm/.network-dispatch
Anti-Debugging	Checks /proc/self/status for TracerPid

---

🧠 MITRE ATT&CK Mapping

Tactic	Technique	ID
Execution	Unix Shell	T1059.004
Persistence	Systemd Service	T1543.002
Defense Evasion	Debugger Evasion	T1622
Discovery	Process Discovery	T1057
C2	Encrypted Channel	T1573
C2	Dynamic Resolution	T1568.002

---

📸 Evidence Walkthrough

Screenshot	What it shows
03-dns-port53-binding-check	Confirming INetSim's DNS wasn't actually listening on port 53
25-dns-fix-disable-systemd-resolved-inetsim-listening	The fix: disabling systemd-resolved, then INetSim's full service list bound and listening
08-sample-extraction-file-type-identification	Extracting the sample and confirming ELF 32-bit type
06-static-analysis-readelf-header-dropped-paths	readelf -h header + dropped-file path strings
07-static-analysis-strings-suspicious-paths	Suspicious strings: fake User-Agent, hidden paths
09-static-analysis-systemd-persistence-strings	Systemd persistence artifacts found in strings
22-kali-to-ubuntu-scp-transfer	Transferring the sample from Kali to the victim VM
13-tcpdump-live-packet-capture	Live tcpdump capture during execution
14-tcpdump-full-capture-104810-packets	Full capture — 104,810 packets
16-dns-queries-c2-domains-captured	DNS queries to the actual C2 domains
11-strace-anti-debug-sigkill-evidence	strace proof of the anti-debugging self-kill
12-dropped-files-find-confirmation	find confirming dropped files across /tmp, /var/tmp, /dev/shm
15-dropped-files-elf-verification-hexdump	Verifying all 3 dropped copies are identical ELF binaries

Full set of 25 screenshots is in /screenshots.

---

🛠️ How to Replicate This Lab

1. Prerequisites

• VirtualBox or VMware Fusion
• Kali Linux ISO
• Ubuntu Server/Desktop ISO
• INetSim installed on Ubuntu

2. Network Setup

# On Ubuntu (Victim)
sudo ip addr add 192.168.56.101/24 dev enp0s3
sudo ip link set enp0s3 up

# On Kali (Analyst)
sudo ip addr add 192.168.56.102/24 dev eth1
sudo ip link set eth1 up

3. INetSim Configuration

See lab-setup/inetsim.conf.

4. DNS Bypass

echo "192.168.56.101 badguy.com evil.com malware.com c2-server.com" | sudo tee -a /etc/hosts

5. Static Analysis

file sample.elf
strings sample.elf | grep -E "http|https|\.com|/bin/|/tmp/"
readelf -h sample.elf

6. Dynamic Analysis

scp sample.elf my@192.168.56.101:/tmp/
sudo tcpdump -i any -n -v -w capture.pcap
./sample.elf &

---

📂 Repository Contents

File	Description
REPORT.md	Full professional analysis report
iocs/iocs.yaml	Structured Indicators of Compromise
iocs/yara-rules/network_dispatch.yar	YARA rule to detect this family
lab-setup/inetsim.conf	INetSim configuration file
lab-setup/hosts	/etc/hosts DNS bypass entries
lab-setup/network-setup.sh	Automated IP configuration script
scripts/extract_strings.sh	Automated static analysis script
scripts/dynamic_run.sh	Automated dynamic analysis script

---

🧑‍🎓 Lessons Learned

1. INetSim DNS binding is finicky — always verify with ss -tulpn.
2. Anti-debugging (TracerPid check) is common — have fallback methods (tcpdump, find).
3. Use tcpdump -i any — not all traffic goes through the physical interface.
4. Snapshots are your best friend — take them before every dynamic run.

---

🛡️ Security & Ethical Statement

This lab was conducted in a fully isolated environment with no internet access from the VMs. The sample was sourced from a legitimate malware research repository (MalwareBazaar) for educational purposes only. No malicious activity was conducted against any third party.

---

🔗 References

• MalwareBazaar
• MITRE ATT&CK
• INetSim

---

Full report: REPORT.md