Threat Intelligence Directory

Malware family identifying elf.kivars. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.kitty_soks5. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.kinsing. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.kfos. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.keyplug. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.kerberods. Origin and technical characteristics tracked via Malpedia.

According to netenrich, Kaiten is a Trojan horse that opens a back door on the compromised computer that allows it to perform other malicious activities. The trojan does not create any copies of itself. This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Surfaced in late April 2020, Intezer describes Kaiji as a DDoS malware written in Go that spreads through SSH brute force attacks. Recovered function names are an English representation of Chinese words, hinting about the origin. The name Kaiji was given by MalwareMustDie based on strings found in samples.

According to Black Lotus Labs, KadNap primarily targets Asus routers, conscripting them into a botnet that proxies malicious traffic. It employs a custom version of the Kademlia Distributed Hash Table (DHT) protocol, which is used to conceal the IP address of their infrastructure within a peer-to-peer system to evade traditional network monitoring.

Kaden is a DDoS botnet that is heavily based on Bashlite/Gafgyt. Next to DDoS capabilities it contains wiper functionality, which currently can not be triggerred (yet).

According to Lumen, J-Magic is a variant of cd00r and passively scans for five different predefined parameters before activating. If any of these parameters or “magic packets” are received, the agent sends back a secondary challenge. Once that challenge is complete, J-magic establishes a reverse shell on the local file system, allowing the operators to control the device, steal data, or deploy malicious software.

Malware family identifying elf.jenx. Origin and technical characteristics tracked via Malpedia.

ccording to Fortinet, this is a Mirai-based DDoS botnet.

Malware family identifying elf.ipstorm. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.iot_reaper. Origin and technical characteristics tracked via Malpedia.

IOControl is a Linux backdoor which targets ARM-based IoT and OT systems, which a particular focus on Fuel and Industrial Control Systems.

According to Sekoia, this is the ransomware used by the Interlock ransomware intrusion set, which was first observed in September 2024 conducting Big Game Hunting and double extortion campaigns.

RAT. Functionality like ExecShell, GetFileList/SendFile/DownloadFile, Socks5, PortmapManager/GetConn/SendConn. Transport also supports Quic. Variants in C# and GO.

Malware family identifying elf.inc. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.icnanker. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.icefire. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.hyperssl. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.hubnr. Origin and technical characteristics tracked via Malpedia.

Checkpoint Research describes this as part of a custom firmware image affiliated with the Chinese state-sponsored actor “Camaro Dragon”, a custom MIPS32 ELF implant. HorseShell, the main implant inserted into the modified firmware by the attackers, provides the attacker with 3 main functionalities: * Remote shell: Execution of arbitrary shell commands on the infected router * File transfer: Upload and download files to and from the infected router. * SOCKS tunneling: Relay communication between different clients.

Malware family identifying elf.hive. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.hipid. Origin and technical characteristics tracked via Malpedia.

HinataBot is a Go-based DDoS-focused botnet. It was observed in the first quarter of 2023 targeting HTTP and SSH endpoints leveraging old vulnerabilities and weak credentials. Amongst those infection vectors are exploitation of the miniigd SOAP service on Realtek SDK devices (CVE-2014-8361), Huawei HG532 routers (CVE-2017-17215), and exposed Hadoop YARN servers.

Malware family identifying elf.hideandseek. Origin and technical characteristics tracked via Malpedia.

HiddenWasp is a Linux-based Trojan used to target systems for remote control. It comes in the form of a statically linked ELF binary with stdlibc++.

Lumen discovered this malware used in campaign targeting business-grade routers using a RAT they call HiatusRAT and a variant of tcpdump for traffic interception.

Linux version of the HelloKitty ransomware.

Malware family identifying elf.hellobot. Origin and technical characteristics tracked via Malpedia.

Ransomware.

Malware family identifying elf.headcrab. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.hand_of_thief. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.handymannypot. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.hakai. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.hajime. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.haiduc. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.hadooken. Origin and technical characteristics tracked via Malpedia.