In this post I will be taking a look at a Linux backdoor known as REKOOBE1 https://malpedia.caad.fkie.fraunhofer.de/details/elf.rekoobe ↩

This walk-through will be dissecting a WARMCOOKIE infection chain from the perspective of a network packet capture and Suricata alerts. The various artefacts for this incident are kindly provided by @malware_traffic and located at malware-traffic-analysis.net.

Welcome back to this series, analysing IcedId malware artefacts.

Welcome back to this series, analysing IcedId malware artefacts.

In a world dominated with endpoint detection and response agents, coming across PCAP may be a rare occurrence.