Loading story…
Researchers and developers published details and tooling that expose how the Ezuri ELF crypter conceals Linux malware in memory and how packed payloads can be recovered. Analysis cited from AT&T Alien Labs described malware using the Ezuri memory loader, which encrypts payloads with AES in CFB mode, stores the key and IV inside the binary, and then decrypts and executes the payload from memory using memfd_create to reduce on-disk artifacts.
A public GitHub project, ezuri_unpack, was released to automate extraction of payloads from Ezuri-packed binaries. The tool is presented as a simple Go-based unpacker built from prior reverse-engineering work and was reportedly tested against a packed Linux.Cephei sample referenced in the Alien Labs research, giving defenders and analysts a practical way to inspect malware hidden by the Ezuri loader.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
A GitHub repository named "ezuri_unpack" was published as a simple unpacking script for the Ezuri ELF Crypter, based on the prior AT&T Alien Labs analysis and tested against a packed Linux.Cephei sample.
Palo Alto Networks Unit 42 published analysis of TeamTNT's Black-T cryptojacking variant targeting exposed Docker APIs, detailing its worm-like propagation, credential theft, and use of Linux memory password scraping tools. The report also identified deployment of an ELF Monero miner named sbin_u and noted TeamTNT's first observed use of zgrab and memory scraping in its tradecraft.
The GitHub repository for Ezuri, described as a simple Linux ELF runtime crypter and memory-loading utility, was publicly present by at least April 26, 2019 based on initial commit timestamps shown in the repository. The project includes source code and build instructions for creating the Ezuri loader.
AT&T Alien Labs researchers Ofer Caspi and Fernando Martinez published analysis of malware using the Ezuri memory loader, documenting that Ezuri-packed payloads use AES-CFB encryption, store the key and IV in the binary, and decrypt and execute payloads via memfd_create.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 51 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
5 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourcebleepingcomputer.com
Open sourceunit42.paloaltonetworks.com
Open sourcecybersecurity.att.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic Security Labs documented how to unpack ICEDID’s fake-GZip variant, a credential- and banking-information-stealing malware family that uses custom file formats and encryption to impede analysis. The examined sample contained an encrypted configuration, core binary, and persistence loader; recovered configuration data identified `alishaskainz[.]com` and `villageskaier[.]com` as C2 domains and `/news/` as the beacon URI. The workflow reconstructs ICEDID custom PE files, including x64 and x86 browser-hook payloads, for static analysis; execution should be limited to isolated environments. Separately, Malpedia published an autogenerated YARA signature for Windows **DarkVNC**. The rule evaluates ten byte-pattern sequences and matches files below 606,208 bytes when at least seven patterns are present, providing a detection option for the remote-access malware family. The reference does not attribute DarkVNC to a specific incident, campaign, or threat actor.
Aug 26, 2026
Researchers detailed how the **ReZer0** .NET loader can be analyzed without running its main entry point, allowing defenders to automatically recover both its embedded payload and configuration. The technique uses C# reflection to load samples as assemblies, enumerate private static fields across classes, identify the payload as a byte array beginning with the `MZ` header, and locate the configuration as a 37-element string array. Because those static fields are populated when the assembly loads, the method exposes already-decrypted data and sidesteps the loader’s encryption and decryption logic. The recovered configurations show ReZer0 supports multiple execution and evasion features, including **process hollowing**, **scheduled task creation**, **remote payload execution**, **anti-virtualization**, **anti-sandbox checks**, message-box display, and sleep-based delays. The extractor was reportedly validated against **215 samples**, with example outputs showing differing configuration values and payloads across campaigns, while separate reporting on .NET loader tradecraft underscores continued attention on loaders that conceal second-stage malware inside managed code.
Aug 15, 2026
Researchers reported a new **PDFly** malware variant that uses a **custom-modified PyInstaller** executable to break common unpacking workflows and force manual reverse engineering. The sample alters PyInstaller identifiers (including a non-standard “magic cookie”) and corrupts strings so tools like *PyInstxtractor* fail to recognize the archive structure; even after adapting extraction scripts to accept the custom cookie and bypass validation checks, the recovered Python components remained **multi-layer encrypted**, with decryption logic implemented in separate bootstrap files that handle runtime extraction. Separately, an educational malware-analysis write-up detailed how to unpack **SnappyBee (Deed RAT)**, a modular backdoor previously reported in China-linked espionage activity and associated in public reporting with **Salt Typhoon / Earth Estries**. The post describes SnappyBee’s **custom packing routine** used to obscure its payload and evade static analysis, and positions the unpacking methodology as a repeatable approach for triaging similarly packed malware (including post-compromise tooling used for persistence and follow-on deployment such as **Cobalt Strike** and the **Demodex** rootkit).
Jun 29, 2026