Static Analysis of Linux Malware Captured by a Cowrie Honeypot

A Cowrie honeypot captured Linux malware after weak SSH and Telnet logins. Payloads include fake-daemon binaries masquerading as sshd and xinetd, a statically linked bot, and a backdoor with three persistence mechanisms. Default-deny egress breaks the final reach-out step.