MalwareMustDie, NPO is a
whitehat
A white hat (or a white-hat hacker, a whitehat) is an ethical security hacker. Ethical hacking is a term meant to imply a broader category than just penetration testing. Under the owner's consent, white-hat hackers aim to identify any vulnerabili ...
security research workgroup that was launched in August 2012. MalwareMustDie is a registered
nonprofit organization as a medium for IT professionals and security researchers gathered to form a work flow to reduce
malware
Malware (a portmanteau for ''malicious software'') is any software intentionally designed to cause disruption to a computer, server, client, or computer network, leak private information, gain unauthorized access to information or systems, depri ...
infection in the
internet. The group is known for their malware analysis blog. They have a list of
Linux malware research and botnet analysis that they have completed. The team communicates information about malware in general and advocates for better detection for
Linux malware.
MalwareMustDie is also known for their efforts in original analysis for a new emerged malware or botnet, sharing of their found malware source code to the law enforcement and security industry, operations to dismantle several malicious infrastructure, technical analysis on specific malware's infection methods and reports for the cyber crime emerged toolkits.
Several notable internet threats that were first discovered and announced by MalwareMustDie are:
*Prison Locker (
ransomware
Ransomware is a type of malware from cryptovirology that threatens to publish the victim's personal data or permanently block access to it unless a ransom is paid off. While some simple ransomware may lock the system without damaging any files, ...
)
*Mayhem (Linux botnet)
*Kelihos botnet v2
*ZeusVM
*Darkleech botnet analysis
*KINS (Crime Toolkit)
*Cookie Bomb (malicious
PHP traffic redirection)
*
Mirai
*LuaBot
*NyaDrop
*NewAidra or IRCTelnet
*Torlus aka Gafgyt/Lizkebab/Bashdoor/Qbot/
BASHLITE)
*LightAidra
*PNScan
*STD Bot
*Kaiten botnets (
Linux DDoS or malicious proxy
botnet Linux malware)
*ChinaZ (China
DDoS Trojan)
*
Xor DDoS
XOR DDoS is a Linux Trojan malware with rootkit capabilities that was used to launch large-scale DDoS attacks. Its name stems from the heavy usage of XOR encryption in both malware and network communication to the C&Cs. It is built for multiple Lin ...
(China DDoS Trojan)
*IpTablesx (China DDoS Trojan)
*DDoSTF (China DDoS Trojan)
*DESDownloader (China DDoS Trojan)
*Cayosin DDoS botnet
*DDoSMan (China DDoS Trojan)
*AirDropBot DDoS botnet
*Mirai FBot DDoS botnet
*Kaiji IoT DDoS/bruter botnet
MalwareMustDie has also been active in analysis for client vector threat's vulnerability. For example,
Adobe Flash (LadyBoyle SWF exploit) and other undisclosed Adobe vulnerabilities in 2014 have received Security Acknowledgments for Independent Security Researchers from Adobe. Another vulnerability researched by the team was reverse engineering a proof of concept for a backdoor case () of one brand of Android phone device that was later found to affect 2 billion devices.
Recent activity of the team still can be seen in several noted threat disclosures, for example, the "FHAPPI" state-sponsored malware attack, the finding of first ARC processor malware, and "Strudel" threat analysis (credential stealing scheme).
The team continues to post new Linux malware research on Twitter and their subreddit.
References
{{reflist
Security
White hat (computer security)