A Portable Executable (.EXE), ELF64 and HTML polyglot that runs natively on Windows, Linux and in the Browser.

A Portable Executable (.EXE), ELF64 and HTML polyglot that runs natively on Windows, Linux and in the Browser.

A Portable Executable (.EXE), ELF64 and HTML polyglot that runs natively on Windows, Linux and in the Browser.

Exploring ELF program headers, tables and executable layout while building a binary inspector in Zig.

A Portable Executable (.EXE), ELF64 and HTML polyglot that runs natively on Windows, Linux and in the Browser.

📅 Source : RansomLook (ransomlook.io), rapport de rétro-ingénierie publié le 2026-08-29, basé sur l'analyse statique du binaire SHA-256 33d3afddaa5710cdcc4e93a7bae8be010c19747fb53d85fcd54ef32056a1eb0b. ZAWOOO est un encrypteur Linux/ELF64 statique-pie conçu exclusivement pour les NAS Synology DSM.

A new variant of the SysUpdate malware has emerged as a sophisticated threat targeting Linux systems with advanced command-and-control (C2) encryption capabilities. The malware was discovered during a Digital Forensics and Incident Response (DFIR) engagement when security teams detected the suspicious Linux binary in a client’s environment. This packed ELF64 executable uses an unknown obfuscated packer with no section header, making traditional analysis methods challenging. The threat disguises itself as a legitimate system service, and when executed without specific arguments, it performs reconnaissance by running the GNU/Linux ID command to gather system information before establishing encrypted network communications across multiple protocols. LevelBlue analysts identified strong indicators linking the sample to a new version of SysUpdate after conducting dynamic analysis and examining endpoint detection metrics. The researchers confirmed this attribution with high confidence through comprehensive reverse engineering efforts. The malware’s C++ codebase implements complex cryptographic routines that encrypt its C2 traffic, creating a significant obstacle for network-based detection and traffic analysis. In response to this challenge, cybersecurity researchers developed specialized tooling using the Unicorn Engine emulation framework to decrypt the malware’s encrypted communications without fully understanding the underlying encryption algorithm. LevelBlue researchers noted that the decryption tool was built during an active incident investigation, demonstrating rapid response capabilities in real-world scenarios. The technical approach involved extracting machine code bytes, global data structures, heap values, and CPU register states from the malware sample during runtime. Key generation (Source – LevelBlue) By emulating the malware’s key generation and encryption routines, analysts successfully decrypted intercepted C2 traffic and exposed the plaintext communications. Encrypted key data (Source – LevelBlue) The methodology relies on Binary Ninja for static analysis, GDB for dynamic debugging, and Rust-based Unicorn Engine bindings to emulate x86-64 assembly code without completely reverse engineering the complex cryptographic implementation. Decryption Tool Development and Methodology The decryption solution uses CPU emulation to leverage the malware’s own cryptographic functions against itself. Researchers created two separate emulators working in tandem: one for key generation that processes the hardcoded plaintext encryption key extracted from the malware’s heap memory, and another for decryption that processes 8-byte data blocks using XOR operations combined with an unknown encryption algorithm. Emulation layer (Source – LevelBlue) The emulation environment replicates the exact memory mappings from the malware’s process space, including stack addresses, heap structures, data segments containing cryptographic constants, and code segments with the encryption routines. This approach allows security teams to decrypt C2 traffic from any sample in this malware family by simply extracting the new encryption key from future variants. Organizations should deploy endpoint detection solutions capable of monitoring for packed ELF executables with suspicious system service behavior. Security teams should implement network traffic analysis to identify encrypted communications patterns, even when decryption is not immediately possible. Incident response procedures should include capabilities for rapid malware emulation and reverse engineering to develop custom decryption tools during active investigations. Follow us on  Google News ,  LinkedIn , and  X  to Get More Instant Updates ,  Set CSN as a Preferred Source in  Google . The post New SysUpdate Variant Malware Discovered and Tool Developed to Decrypt Encrypted Linux C2 Traffic appeared first on Cyber Security News .

c89cc.sh - standalone C89/ELF64 compiler in pure portable shell - c89cc.sh

A Portable Executable (.EXE), ELF64 and HTML polyglot that runs natively on Windows, Linux and in the Browser.

KrackM3 is a reverse engineering challenge that presents a Linux ELF64 binary implementing a custom cryptographic validation scheme. The binary verifies a 32-character flag using a sophisticated multi-layer cipher combining: Fisher-Yates S-Box generation with xorshift PRNG A 256-byte random lookup table generated via xorshift64* algorithm FNV-1a inspired hash state updates with rotation operations 4-way parallel validation accumulators using OR-based error accumulation…