flowchart LR
DELIVERY["Delivery Source"]
DELIVERY --> ARCHIVE["Archive or<br/>Package"]
DELIVERY --> SCRIPTFILE["Script File"]
DELIVERY --> APP["Trojanized<br/>Application"]
DELIVERY --> WEBENTRY["Web or<br/>Server Entry"]
DELIVERY --> CONTAINERIMG["Container<br/>Image"]
ARCHIVE --> PACKAGE["Package<br/>Handling"]
SCRIPTFILE --> INTERPRETER["Interpreter<br/>Execution"]
APP --> NATIVE["Native ELF<br/>Execution"]
WEBENTRY --> SERVER["Server-Side<br/>Execution"]
CONTAINERIMG --> CONTAINER["Container<br/>Execution"]
PACKAGE --> DEB["DEB or RPM"]
PACKAGE --> TAR["TAR, GZ or XZ"]
PACKAGE --> APPIMAGE["AppImage"]
INTERPRETER --> SHELL["Bash or Shell"]
INTERPRETER --> PYTHON["Python"]
INTERPRETER --> PERL["Perl"]
INTERPRETER --> PHP["PHP"]
INTERPRETER --> JS["JavaScript"]
SERVER --> WEBSHELL["Web Shell"]
SERVER --> CGI["CGI Script"]
SERVER --> MODULE["Server Module"]
SHELL --> PAYLOAD["Secondary<br/>Component"]
PYTHON --> PAYLOAD
PERL --> PAYLOAD
PHP --> PAYLOAD
JS --> PAYLOAD
DEB --> PAYLOAD
TAR --> PAYLOAD
APPIMAGE --> NATIVE
WEBSHELL --> PAYLOAD
CGI --> PAYLOAD
PAYLOAD --> ELF["ELF Payload"]
PAYLOAD --> SO["Shared Object"]
PAYLOAD --> MEMORY["Memory-Resident<br/>Component"]
PAYLOAD --> KMOD["Kernel Module"]
PAYLOAD --> SERVICE["Persistence<br/>Component"]
NATIVE --> ELF
NATIVE --> SO
MODULE --> SO
CONTAINER --> ENTRYPOINT["Entrypoint Script"]
CONTAINER --> CELF["Container ELF<br/>Payload"]
CONTAINER --> CMEM["Memory-Resident<br/>Component"]
ENTRYPOINT --> PAYLOAD
CELF --> OBJECTIVE["Malware<br/>Objectives"]
CMEM --> OBJECTIVE
ELF --> OBJECTIVE
SO --> OBJECTIVE
MEMORY --> OBJECTIVE
KMOD --> OBJECTIVE
SERVICE --> OBJECTIVE
OBJECTIVE --> PERSISTENCE["Persistence"]
OBJECTIVE --> EVASION["Defense<br/>Evasion"]
OBJECTIVE --> THEFT["Information<br/>Theft"]
OBJECTIVE --> CONTROL["Remote<br/>Control"]
OBJECTIVE --> ABUSE["Resource<br/>Abuse"]
OBJECTIVE --> IMPACT["Encryption or<br/>Destruction"]
classDef stage fill:#7f1d1d,color:#ffffff,stroke:#450a0a,stroke-width:2px
classDef format fill:#fee2e2,color:#450a0a,stroke:#dc2626
classDef objective fill:#ffedd5,color:#431407,stroke:#f97316
class DELIVERY,PACKAGE,INTERPRETER,NATIVE,SERVER,CONTAINER,PAYLOAD,OBJECTIVE stage
class ARCHIVE,SCRIPTFILE,APP,WEBENTRY,CONTAINERIMG format
class DEB,TAR,APPIMAGE,SHELL,PYTHON,PERL,PHP,JS format
class WEBSHELL,CGI,MODULE,ELF,SO,MEMORY,KMOD,SERVICE format
class ENTRYPOINT,CELF,CMEM format
class PERSISTENCE,EVASION,THEFT,CONTROL,ABUSE,IMPACT objective
- Awesome Static Linux Malware Analysis
- Awesome Dynamic Linux Malware Analysis
- Awesome Linux Malware Analysis Resources
- Awesome Graph based Linux Malware Detection
- Awesome Static Linux Malware Detection Scientific Research
- Awesome Dynamic Linux Malware Detection Scientific Research
- Awesome Graph based Linux Malware Detection Scientific Research
You can access the my other awesome lists here
Contributions of any kind welcome, just follow the guidelines!
Thanks goes to these contributors!
