# Analyzing Linux Elf Malware

Analyze malicious Linux ELF binaries, botnets, cryptominers, ransomware, and rootkits...

- Repository: https://github.com/mukul975/Anthropic-Cybersecurity-Skills (35398 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-08-31
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-linux-elf-malware -g -a claude-code -y`
Codex: `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-linux-elf-malware -g -a codex -y`
Cursor: `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-linux-elf-malware -g -a cursor -y`
Gemini CLI: `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-linux-elf-malware -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add mukul975/Anthropic-Cybersecurity-Skills`

## Description

Analyze malicious Linux ELF binaries, botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure, through static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM samples. Use when investigating Linux malware, triaging a suspicious ELF binary, assessing a compromised Linux server, or analyzing container-targeted malware.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Analyzing Linux ELF Malware

## When to Use

- A Linux server or container has been compromised and suspicious ELF binaries are found
- Analyzing Linux botnets (Mirai, Gafgyt, XorDDoS), cryptominers, or ransomware
- Investigating malware targeting cloud infrastructure, Docker containers, or Kubernetes pods
- Reverse engineering Linux rootkits and kernel modules
- Analyzing cross-platform malware compiled for Linux x86_64, ARM, or MIPS architectures

**Do not use** for Windows PE binary analysis; use PEStudio, Ghidra, or IDA for Windows malware.

## Prerequisites

- Ghidra or IDA with Linux ELF support for disassembly and decompilation
- Linux analysis VM (Ubuntu 22.04 recommended) with development tools installed
- strace, ltrace, and GDB for dynamic analysis and debugging
- readelf, objdump, and nm from GNU binutils for static inspection
- Radare2 for quick binary triage and scripted analysis
- Docker for isolated container-based malware execution

## Workflow

### Step 1: Identify ELF Binary Properties

Examine the ELF header and basic properties:

```bash
# File type identification
file suspect_binary

# Detailed ELF header analysis
readelf -h suspect_binary

# Section headers
readelf -S suspect_binary

# Program headers (segments)
readelf -l suspect_binary

# Symbol table (if not stripped)
readelf -s suspect_binary
nm suspect_binary 2>/dev/null

# Dynamic linking information
readelf -d suspect_binary
ldd suspect_binary 2>/dev/null  # Only on matching architecture!

# Compute hashes
md5sum suspect_binary
sha256sum suspect_binary

# Check for packing/UPX
upx -t suspect_binary
```

```python
# Python-based ELF analysis
from elftools.elf.elffile import ELFFile
import hashlib

with open("suspect_binary", "rb") as f:
    data = f.read()
    sha256 = hashlib.sha256(data).hexdigest()

with open("suspect_binary", "rb") as f:
    elf = ELFFile(f)

The rest: https://github.com/mukul975/Anthropic-Cybersecurity-Skills/blob/HEAD/skills/analyzing-linux-elf-malware/SKILL.md