On: Linux.Rex.1 – A multifunctional self-replicating Trojan for Linux written in Go

[wangchow]

Funny the binary has the strings embedded in them. You'd think they'd at least make it better at hiding itself. You could just do "strings <binfile>" to find them

"We are Anonymous. All your servers will be DDoS-ed starting {{ .Time.Weekday.String }} ({{ .Time.Format "Jan 2 2006" }}) if you don't pay {{ .Amount }} Bitcoins @"

[parenthephobia → wangchow]

How often do you check your binaries to find out if they've got suspicious strings in them? :)

I think if you're at the point of running strings on it, you're probably already pretty sure the binary is not above-board.

[oinksoft → parenthephobia]

Obligatory warning about running `strings` on untrusted files: https://lcamtuf.blogspot.com/2014/10/psa-dont-run-strings-on...

[wangchow → oinksoft]

Ah good call.

[wangchow → parenthephobia]

Hmm. Yeah lol I never run it actually. Still though, if I was writing some malware first question I would ask is how to hide it from people.