{"id":16963254,"url":"https://github.com/ruzickap/malware-cryptominer-container","last_synced_at":"2025-03-21T16:25:42.454Z","repository":{"id":62692814,"uuid":"561692243","full_name":"ruzickap/malware-cryptominer-container","owner":"ruzickap","description":"Container image with malware and crypto miner for testing purposes","archived":false,"fork":false,"pushed_at":"2025-03-16T03:23:30.000Z","size":919,"stargazers_count":43,"open_issues_count":1,"forks_count":22,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-03-16T03:23:31.769Z","etag":null,"topics":["container","crypto","cryptominer","dockerfile","eicar","image","malware","public","test","xmrig"],"latest_commit_sha":null,"homepage":"https://artifacthub.io/packages/container/malware-cryptominer-container/malware-cryptominer-container","language":"Dockerfile","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ruzickap.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-11-04T09:16:06.000Z","updated_at":"2025-03-16T02:20:46.000Z","dependencies_parsed_at":"2023-10-11T17:03:43.893Z","dependency_job_id":"ec736613-da13-43bf-ab98-ad0cb5622f07","html_url":"https://github.com/ruzickap/malware-cryptominer-container","commit_stats":null,"previous_names":[],"tags_count":32,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ruzickap%2Fmalware-cryptominer-container","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ruzickap%2Fmalware-cryptominer-container/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ruzickap%2Fmalware-cryptominer-container/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ruzickap%2Fmalware-cryptominer-container/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ruzickap","download_url":"https://codeload.github.com/ruzickap/malware-cryptominer-container/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244827508,"owners_count":20516953,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["container","crypto","cryptominer","dockerfile","eicar","image","malware","public","test","xmrig"],"created_at":"2024-10-13T23:24:09.907Z","updated_at":"2025-03-21T16:25:42.445Z","avatar_url":"https://github.com/ruzickap.png","language":"Dockerfile","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Container image with malware and crypto miner for testing purposes\n\n[![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/malware-cryptominer-container)](https://artifacthub.io/packages/search?repo=malware-cryptominer-container)\n[![Container build](https://github.com/ruzickap/malware-cryptominer-container/actions/workflows/container-build.yml/badge.svg)](https://github.com/ruzickap/malware-cryptominer-container/actions/workflows/container-build.yml)\n![Docker Image Size (latest semver)](https://img.shields.io/docker/image-size/peru/malware-cryptominer-container?logo=docker\u0026logoColor=white\u0026sort=semver)\n[![GitHub release (latest SemVer)](https://img.shields.io/github/v/release/ruzickap/malware-cryptominer-container?logo=github\u0026sort=semver)](https://github.com/ruzickap/malware-cryptominer-container/releases/latest)\n[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/ruzickap/malware-cryptominer-container/badge)](https://scorecard.dev/viewer/?uri=github.com/ruzickap/malware-cryptominer-container)\n[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/9865/badge)](https://www.bestpractices.dev/projects/9865)\n\n[![Open in GitHub Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/ruzickap/malware-cryptominer-container)\n\n![Ransomware](https://raw.githubusercontent.com/MISP/intelligence-icons/52d597bf00d58b92ee8809802b507c6d0755235f/svg/ransomware.svg)\n![Malware](https://raw.githubusercontent.com/MISP/intelligence-icons/513abc840b7ac92e4f8a4a7ecab2964007bf25f5/svg/malware.svg)\n![Threat Actor](https://raw.githubusercontent.com/MISP/intelligence-icons/513abc840b7ac92e4f8a4a7ecab2964007bf25f5/svg/threat_actor.svg)\n\n- [Container image with malware and crypto miner for testing purposes](#container-image-with-malware-and-crypto-miner-for-testing-purposes)\n  - [Deployment of the vulnerable image](#deployment-of-the-vulnerable-image)\n    - [CloudFormation - EC2 instance](#cloudformation---ec2-instance)\n    - [Amazon ECS](#amazon-ecs)\n    - [Amazon EKS](#amazon-eks)\n  - [Scanner tests](#scanner-tests)\n  - [Verify image integrity](#verify-image-integrity)\n  - [Local tests](#local-tests)\n\nI decided to build minimal [nginx](https://hub.docker.com/_/nginx) based\n[container image](https://quay.io/repository/petr_ruzicka/malware-cryptominer-container?tab=tags\u0026tag=latest)\nwhich contains malware / ransomware / crypto miner / ...\n\nSecurity tools should be able to scan the image and discover harmful files.\n\n\u003e Running/starting the [container image](https://quay.io/repository/petr_ruzicka/malware-cryptominer-container?tab=tags)\n\u003e do not \"activate\" / \"execute\" the malware.\n\n- Container Image:\n  - [quay.io/petr_ruzicka/malware-cryptominer-container:3](https://quay.io/petr_ruzicka/malware-cryptominer-container:3)\n- Container Registry:\n  - \u003chttps://quay.io/repository/petr_ruzicka/malware-cryptominer-container?tab=tags\u003e\n- Container build pipeline:\n  - \u003chttps://github.com/ruzickap/malware-cryptominer-container/actions/workflows/container-build.yml\u003e\n- Dockerfile used for building the container:\n  - \u003chttps://github.com/ruzickap/malware-cryptominer-container/blob/main/Dockerfile\u003e\n\nThe malware files inside container image were downloaded from:\n\n- [eicar](https://www.eicar.org/download-anti-malware-testfile/)\n- [xmrig](https://xmrig.com/)\n- \u003chttps://github.com/Da2dalus/The-MALWARE-Repo\u003e\n- \u003chttps://github.com/timb-machine/linux-malware\u003e\n- \u003chttps://github.com/antonioCoco/ConPtyShell\u003e\n- \u003chttps://github.com/HonbraDev/fractureiser-samples\u003e\n\nThe malware/crypto miner files are located in the `/usr/share/nginx/html`\ndirectory:\n\n```text\n/usr/share/nginx/html\n├── eicar\n│   ├── eicar.com                        [EICAR virus test files]\n│   ├── eicar.com.txt                    [EICAR virus test files]\n│   └── eicarcom2.zip                    [Zip archive data, at least v1.0 to extract]\n├── malware\n│   ├── ILOVEYOU.vbs                     [C source, ASCII text]\n│   ├── Invoke-ConPtyShell.ps1           [ASCII text, with very long lines (361)]\n│   ├── L0Lz.bat                         [DOS batch file, ASCII text]\n│   ├── Linux.Trojan.Multiverze.elf.x86  [ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, with debug_info, not stripped]\n│   ├── MadMan.exe                       [MS-DOS executable, MZ for MS-DOS]\n│   ├── Melissa.doc                      [Composite Document File V2 Document, Little Endian, Os: Windows, Version 4.10, Code page: 1252, Title: Password List for March 26th 1999, Subject: Adult Website Passwords, Author: John Holmes, Keywords: 73 sites in this list, Comments: Password List for March 26th 1999, Template: Normal.dot, Last Saved By: Him, Revision Number: 2, Name of Creating Application: Microsoft Word 8.0, Create Time/Date: Fri Mar 26 11:39:00 1999, Last Saved Time/Date: Fri Mar 26 11:39:00 1999, Number of Pages: 2, Number of Words: 745, Number of Characters: 4249, Security: 0]\n│   ├── Py.Trojan.NecroBot.py            [Python script, ASCII text executable, with very long lines (4330), with CRLF line terminators]\n│   ├── Trojan.Java.Fractureiser.MTB.jar [Java archive data (JAR)]\n│   ├── TrojanSpy.MacOS.XCSSET.A.bin     [Mach-O 64-bit x86_64 executable, flags:\u003cNOUNDEFS|DYLDLINK|TWOLEVEL|PIE\u003e]\n│   ├── Txt.Malware.Sustes.sh            [Bourne-Again shell script, ASCII text executable]\n│   ├── Unix.Downloader.Rocke.sh         [POSIX shell script, ASCII text executable]\n│   ├── Unix.Malware.Kaiji.elf.arm       [ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, Go, stripped]\n│   ├── Unix.Trojan.Mirai.elf.m68k       [ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped]\n│   ├── Unix.Trojan.Mirai.elf.mips       [ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, not stripped]\n│   ├── Unix.Trojan.Mirai.elf.ppc        [ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, not stripped]\n│   ├── Unix.Trojan.Mirai.elf.sparc      [ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, not stripped]\n│   ├── Unix.Trojan.Mirai.elf.x86_64     [ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, stripped]\n│   ├── Unix.Trojan.Spike.elf.arm        [ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, for GNU/Linux 2.6.16, with debug_info, not stripped]\n│   ├── Walker.com                       [DOS executable (COM), start instruction 0xe9cd04e8 5400e871]\n│   ├── WannaCry.exe                     [PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections]\n│   ├── Win.Trojan.Perl.perl             [Perl script text executable]\n│   └── Zloader.xlsm                     [Microsoft Excel 2007+]\n└── xmrig\n    ├── my-xmrig                         [ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped]\n    ├── xmrig                            [ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped]\n    └── xmrig-linux-static-x64.tar.gz    [gzip compressed data, from Unix, original size modulo 2^32 8291840]\n```\n\nList of malware/ransomware/crypto miner files:\n\n- [eicar](https://secure.eicar.org/eicar.com)\n  [EICAR virus test files]\n  - [Virustotal](https://www.virustotal.com/gui/file/275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f)\n  - [Hybrid Analysis](https://www.hybrid-analysis.com/sample/275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f/)\n- [xmrig](https://xmrig.com/)\n  [ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, stripped]\n  - [Virustotal](https://www.virustotal.com/gui/file/0ad68d5804804c25a6f6f3d87cc3a3886583f69b7115ba01ab7c6dd96a186404)\n  - [Hybrid Analysis](https://www.hybrid-analysis.com/sample/0ad68d5804804c25a6f6f3d87cc3a3886583f69b7115ba01ab7c6dd96a186404)\n- [ILOVEYOU.vbs](https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Email-Worm/ILOVEYOU.vbs)\n  [C source, ASCII text]\n  - [Virustotal](https://www.virustotal.com/gui/file/556700ac50ffa845e5de853498242ee5abb288eb5b8ae1ae12bfdb5746e3b7b1)\n  - [Hybrid Analysis](https://www.hybrid-analysis.com/sample/556700ac50ffa845e5de853498242ee5abb288eb5b8ae1ae12bfdb5746e3b7b1)\n- [Invoke-ConPtyShell.ps1](https://github.com/antonioCoco/ConPtyShell/blob/master/Invoke-ConPtyShell.ps1)\n  [ASCII text, with very long lines (361)]\n  - [Virustotal](https://www.virustotal.com/gui/file/90a17fd47fe1042cd86ae32fba8d9a5ccdef6162578d9c384fe534112700fb64)\n  - [Hybrid Analysis](https://www.hybrid-analysis.com/sample/90a17fd47fe1042cd86ae32fba8d9a5ccdef6162578d9c384fe534112700fb64)\n- [L0Lz.bat](https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/L0Lz.bat)\n  [DOS batch file, ASCII text]\n  - [Virustotal](https://www.virustotal.com/gui/file/fc94130b45112bdf7fe64713eb807f4958cdcdb758c25605ad9318cd5a8e17ae)\n  - [Hybrid Analysis](https://www.hybrid-analysis.com/sample/fc94130b45112bdf7fe64713eb807f4958cdcdb758c25605ad9318cd5a8e17ae)\n- [Linux.Trojan.Multiverze.elf.x86](https://github.com/timb-machine/linux-malware/raw/main/malware/binaries/Linux.Trojan.Multiverze/0a5a7008fa1a17c8ee32ea4e2f7e25d7302f9dfc4201c16d793a1d03f95b9fa5.elf.x86)\n  [ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), ...]\n  - [Virustotal](https://www.virustotal.com/gui/file/0a5a7008fa1a17c8ee32ea4e2f7e25d7302f9dfc4201c16d793a1d03f95b9fa5)\n  - [Hybrid Analysis](https://www.hybrid-analysis.com/sample/0a5a7008fa1a17c8ee32ea4e2f7e25d7302f9dfc4201c16d793a1d03f95b9fa5)\n- [MadMan.exe](https://github.com/Da2dalus/The-MALWARE-Repo/raw/master/Virus/MadMan.exe)\n  [MS-DOS executable]\n  - [Virustotal](https://www.virustotal.com/gui/file/17d81134a5957fb758b9d69a90b033477a991c8b0f107d9864dc790ca37e6a23)\n  - [Hybrid Analysis](https://www.hybrid-analysis.com/sample/17d81134a5957fb758b9d69a90b033477a991c8b0f107d9864dc790ca37e6a23)\n- [Melissa.doc](https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Virus/Melissa.doc)\n  [Composite Document File V2 Document, Little Endian, Os: Windows, Version\n  4.10, ...]\n  - [Virustotal](https://www.virustotal.com/gui/file/554701bc874da646285689df79e5002b3b1a1f76daf705bea9586640026697ca)\n  - [Hybrid Analysis](https://www.hybrid-analysis.com/sample/554701bc874da646285689df79e5002b3b1a1f76daf705bea9586640026697ca)\n- [Py.Trojan.NecroBot.py](https://github.com/timb-machine/linux-malware/raw/main/malware/binaries/Py.Trojan.NecroBot/0e600095a3c955310d27c08f98a012720caff698fe24303d7e0dcb4c5e766322.py)\n  [Python script, ASCII text executable, with very long lines (4330), with CRLF\n  ...]\n  - [Virustotal](https://www.virustotal.com/gui/file/0e600095a3c955310d27c08f98a012720caff698fe24303d7e0dcb4c5e766322)\n  - [Hybrid Analysis](https://www.hybrid-analysis.com/sample/0e600095a3c955310d27c08f98a012720caff698fe24303d7e0dcb4c5e766322)\n- [Trojan:Java/Fractureiser!MTB](https://github.com/HonbraDev/fractureiser-samples/raw/221bcc4bf45d5896f8908b21d5a8f3e7fcbc2875/stage-0-infected-DisplayEntityEditor-1.0.4.jar)\n  [Java archive data (JAR)]\n  - [Virustotal](https://www.virustotal.com/gui/file/d79874c1a0040cb29418343c766d2f6c69cf8fa5ecd0629cac7cc60d69c4f107)\n  - [Hybrid Analysis](https://www.hybrid-analysis.com/sample/d79874c1a0040cb29418343c766d2f6c69cf8fa5ecd0629cac7cc60d69c4f107)\n- [TrojanSpy.MacOS.XCSSET.A](https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/XCSSETMacMalware/TrojanSpy.MacOS.XCSSET.A.6614978ab256f922d7b6dbd7cc15c6136819f4bcfb5a0fead480561f0df54ca6)\n  [Mach-O 64-bit x86_64 executable, flags:\u003cNOUNDEFS|DYLDLINK|...\u003e]\n  - [Virustotal](https://www.virustotal.com/gui/file/6614978ab256f922d7b6dbd7cc15c6136819f4bcfb5a0fead480561f0df54ca6)\n  - [Hybrid Analysis](https://www.hybrid-analysis.com/sample/6614978ab256f922d7b6dbd7cc15c6136819f4bcfb5a0fead480561f0df54ca6)\n- [Txt.Malware.Sustes.sh](https://github.com/timb-machine/linux-malware/raw/main/malware/binaries/Txt.Malware.Sustes/0e77291955664d2c25d5bfe617cec12a388e5389f82dee5ae4fd5c5d1f1bdefe.sh)\n  [Bourne-Again shell script, ASCII text executable]\n  - [Virustotal](https://www.virustotal.com/gui/file/0e77291955664d2c25d5bfe617cec12a388e5389f82dee5ae4fd5c5d1f1bdefe)\n  - [Hybrid Analysis](https://www.hybrid-analysis.com/sample/0e77291955664d2c25d5bfe617cec12a388e5389f82dee5ae4fd5c5d1f1bdefe)\n- [Unix.Downloader.Rocke.sh](https://github.com/timb-machine/linux-malware/raw/main/malware/binaries/Unix.Downloader.Rocke/228ec858509a928b21e88d582cb5cfaabc03f72d30f2179ef6fb232b6abdce97.sh)\n  [POSIX shell script, ASCII text executable]\n  - [Virustotal](https://www.virustotal.com/gui/file/228ec858509a928b21e88d582cb5cfaabc03f72d30f2179ef6fb232b6abdce97)\n  - [Hybrid Analysis](https://www.hybrid-analysis.com/sample/228ec858509a928b21e88d582cb5cfaabc03f72d30f2179ef6fb232b6abdce97)\n- [Unix.Malware.Kaiji.elf.arm](https://github.com/timb-machine/linux-malware/raw/main/malware/binaries/Unix.Malware.Kaiji/3e68118ad46b9eb64063b259fca5f6682c5c2cb18fd9a4e7d97969226b2e6fb4.elf.arm)\n  [ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked,\n  ...]\n  - [Virustotal](https://www.virustotal.com/gui/file/3e68118ad46b9eb64063b259fca5f6682c5c2cb18fd9a4e7d97969226b2e6fb4)\n  - [Hybrid Analysis](https://www.hybrid-analysis.com/sample/3e68118ad46b9eb64063b259fca5f6682c5c2cb18fd9a4e7d97969226b2e6fb4)\n- [Unix.Trojan.Mirai.elf.m68k](https://github.com/timb-machine/linux-malware/raw/main/malware/binaries/Unix.Trojan.Mirai/11242cdb5dac9309a2f330bd0dad96efba9ccc9b9d46f2361e8bf8e4cde543c1.elf.m68k)\n  [ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), ...]\n  - [Virustotal](https://www.virustotal.com/gui/file/11242cdb5dac9309a2f330bd0dad96efba9ccc9b9d46f2361e8bf8e4cde543c1)\n  - [Hybrid Analysis](https://www.hybrid-analysis.com/sample/11242cdb5dac9309a2f330bd0dad96efba9ccc9b9d46f2361e8bf8e4cde543c1)\n- [Unix.Trojan.Mirai.elf.mips](https://github.com/timb-machine/linux-malware/raw/main/malware/binaries/Unix.Trojan.Mirai/faa0deaba42ba76192609c5d2f59664e871c7bc68ebb5d99c91bf8ea4ddb8ea5.elf.mips)\n  [ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked,\n  ...]\n  - [Virustotal](https://www.virustotal.com/gui/file/faa0deaba42ba76192609c5d2f59664e871c7bc68ebb5d99c91bf8ea4ddb8ea5)\n  - [Hybrid Analysis](https://www.hybrid-analysis.com/sample/faa0deaba42ba76192609c5d2f59664e871c7bc68ebb5d99c91bf8ea4ddb8ea5)\n- [Unix.Trojan.Mirai.elf.ppc](https://github.com/timb-machine/linux-malware/raw/main/malware/binaries/Unix.Trojan.Mirai/d5230c95c4af4e1fcddf9660070932b7876a9569dc3a2baedf762abbe37b1ad5.elf.ppc)\n  [ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV),\n  ...]\n  - [Virustotal](https://www.virustotal.com/gui/file/d5230c95c4af4e1fcddf9660070932b7876a9569dc3a2baedf762abbe37b1ad5)\n  - [Hybrid Analysis](https://www.hybrid-analysis.com/sample/d5230c95c4af4e1fcddf9660070932b7876a9569dc3a2baedf762abbe37b1ad5)\n- [Unix.Trojan.Mirai.elf.sparc](https://github.com/timb-machine/linux-malware/raw/main/malware/binaries/Unix.Trojan.Mirai/190333b93af51f9a3e3dc4186e4f1bdb4f92c05d3ce047fbe5c3670d1b5a87b4.elf.sparc)\n  [ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, ...]\n  - [Virustotal](https://www.virustotal.com/gui/file/190333b93af51f9a3e3dc4186e4f1bdb4f92c05d3ce047fbe5c3670d1b5a87b4)\n  - [Hybrid Analysis](https://www.hybrid-analysis.com/sample/190333b93af51f9a3e3dc4186e4f1bdb4f92c05d3ce047fbe5c3670d1b5a87b4)\n- [Unix.Trojan.Mirai.elf.x86_64](https://github.com/timb-machine/linux-malware/raw/main/malware/binaries/Unix.Trojan.Mirai/40e8d9d82800728a5f1cfc2c2e156d5ee72fb44c54c26a86cfd35e95ea737e37.elf.x86_64)\n  [ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked,\n  ...]\n  - [Virustotal](https://www.virustotal.com/gui/file/40e8d9d82800728a5f1cfc2c2e156d5ee72fb44c54c26a86cfd35e95ea737e37)\n  - [Hybrid Analysis](https://www.hybrid-analysis.com/sample/40e8d9d82800728a5f1cfc2c2e156d5ee72fb44c54c26a86cfd35e95ea737e37)\n- [Unix.Trojan.Spike.elf.arm](https://github.com/timb-machine/linux-malware/raw/main/malware/binaries/Unix.Trojan.Spike/04d88a0f5ffa8da57cfd9b1ae6e4fd9758610a3de72688516b258b5564735476.elf.arm)\n  [ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked,\n  ...]\n  - [Virustotal](https://www.virustotal.com/gui/file/04d88a0f5ffa8da57cfd9b1ae6e4fd9758610a3de72688516b258b5564735476)\n  - [Hybrid Analysis](https://www.hybrid-analysis.com/sample/04d88a0f5ffa8da57cfd9b1ae6e4fd9758610a3de72688516b258b5564735476)\n- [Walker.com](https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Virus/Walker.com)\n  [DOS executable (COM)]\n  - [Virustotal](https://www.virustotal.com/gui/file/b87b48dcbf779b06c6ca6491cd31328cf840578d29a6327b7a44f9043ce1eb07)\n  - [Hybrid Analysis](https://www.hybrid-analysis.com/sample/b87b48dcbf779b06c6ca6491cd31328cf840578d29a6327b7a44f9043ce1eb07)\n- [WannaCry.exe](https://github.com/Da2dalus/The-MALWARE-Repo/raw/master/Ransomware/WannaCry.exe)\n  [PE32 executable (GUI) Intel 80386, for MS Windows]\n  - [Virustotal](https://www.virustotal.com/gui/file/be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844)\n  - [Hybrid Analysis](https://www.hybrid-analysis.com/sample/be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844)\n- [Win.Trojan.Perl.perl](https://github.com/timb-machine/linux-malware/raw/main/malware/binaries/Win.Trojan.Perl/9aed7ab8806a90aa9fac070fbf788466c6da3d87deba92a25ac4dd1d63ce4c44.perl)\n  [Perl script text executable]\n  - [Virustotal](https://www.virustotal.com/gui/file/9aed7ab8806a90aa9fac070fbf788466c6da3d87deba92a25ac4dd1d63ce4c44)\n  - [Hybrid Analysis](https://www.hybrid-analysis.com/sample/9aed7ab8806a90aa9fac070fbf788466c6da3d87deba92a25ac4dd1d63ce4c44)\n- [Zloader.xlsm](https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Banking-Malware/Zloader.xlsm)\n  [Microsoft Excel 2007+]\n  - [Virustotal](https://www.virustotal.com/gui/file/90c03a8ca35c33aad5e77488625598da6deeb08794e6efc9f1ddbe486df33e0c)\n  - [Hybrid Analysis](https://www.hybrid-analysis.com/sample/90c03a8ca35c33aad5e77488625598da6deeb08794e6efc9f1ddbe486df33e0c)\n\n## Deployment of the vulnerable image\n\nThere are several ways how to run the \"malware container image\" and there are\nfew of them.\n\n\u003e Note: Running the container image is not harmful for the host system.\n\n### CloudFormation - EC2 instance\n\nRun the EC2 instance with docker and the [quay.io/petr_ruzicka/malware-cryptominer-container](https://quay.io/repository/petr_ruzicka/malware-cryptominer-container?tab=tags)\ncontainer with SSM enabled (only console access):\n\n```bash\nexport AWS_DEFAULT_REGION=\"eu-central-1\"\n\naws cloudformation deploy --capabilities CAPABILITY_IAM \\\n  --stack-name \"${USER}-malware-cryptominer-container-ec2\" \\\n  --parameter-overrides \"ContainerImage=quay.io/petr_ruzicka/malware-cryptominer-container:3\" \\\n  --template-file EC2InstanceWithDockerSample.yaml \\\n  --tags \"Name=${USER}-malware-cryptominer-container-ec2\"\n\n# aws cloudformation delete-stack --stack-name ${USER}-malware-cryptominer-container-ec2\n```\n\n### Amazon ECS\n\n[Copilot](https://aws.amazon.com/blogs/containers/introducing-aws-copilot/)\nexample:\n\n```bash\nexport AWS_DEFAULT_REGION=\"eu-central-1\"\n\ncopilot init --app \"${USER}-malware-cryptominer-app\" --name \"${USER}-malware-cryptominer\" \\\n  --image quay.io/petr_ruzicka/malware-cryptominer-container:3 \\\n  --type 'Load Balanced Web Service' --port 8080 --deploy\n\n# copilot app delete --name \"${USER}-malware-cryptominer-app\"\n```\n\n### Amazon EKS\n\nRun simple [Amazon EKS](https://aws.amazon.com/eks/) cluster with \"malware pod\":\n\n```bash\nexport AWS_DEFAULT_REGION=\"eu-central-1\"\nexport CLUSTER_NAME=\"${USER}-malware-cryptominer-eks\"\nexport KUBECONFIG=\"/tmp/kubeconfig-${CLUSTER_NAME}.conf\"\n\neksctl create cluster --name \"${CLUSTER_NAME}\" --instance-types t3a.small --kubeconfig \"${KUBECONFIG}\"\nkubectl run malware-cryptominer --image=quay.io/petr_ruzicka/malware-cryptominer-container:3\n\n# eksctl delete cluster --name \"${CLUSTER_NAME}\"\n```\n\n## Scanner tests\n\nDetails from various scanner tests (Aqua, Trivy, Prisma Cloud, Wiz.io, Grype,\nSnyk) can be found in [Scanner tests](./docs/scanner-tests.md)\n\n## Verify image integrity\n\n```bash\nCONTAINER_REGISTRY_IMAGE_NAME=\"quay.io/petr_ruzicka/malware-cryptominer-container\"\nCONTAINER_IMAGE_TAG=\"3\"\nCONTAINER_IMAGE_DIGEST=$(regctl image digest \"${CONTAINER_REGISTRY_IMAGE_NAME}:${CONTAINER_IMAGE_TAG}\")\nCONTAINER_REGISTRY_IMAGE=\"${CONTAINER_REGISTRY_IMAGE_NAME}@${CONTAINER_IMAGE_DIGEST}\"\nCOSIGN_CERTIFICATE_IDENTITY_REGEXP=\"https://github.com/ruzickap/malware-cryptominer-container/.github/workflows\"\nCOSIGN_CERTIFICATE_OIDC_ISSUER=\"https://token.actions.githubusercontent.com\"\nCOSIGN_ATTESTATION_TYPE=\"https://cyclonedx.org/bom\"\nCONTAINER_IMAGE_PLATFORMS=\"linux/amd64,linux/arm64\"\n\n# Verify the manifest list is signed\ncosign verify \\\n  --certificate-identity-regexp=\"${COSIGN_CERTIFICATE_IDENTITY_REGEXP}\" \\\n  --certificate-oidc-issuer=\"${COSIGN_CERTIFICATE_OIDC_ISSUER}\" \\\n  \"${CONTAINER_REGISTRY_IMAGE}\" | jq --color-output\n\n# Verify if every platfrom image manifest is signed\nwhile read -r MANIFEST_DIGESTS; do\n  cosign verify \\\n    --certificate-identity-regexp=\"${COSIGN_CERTIFICATE_IDENTITY_REGEXP}\" \\\n    --certificate-oidc-issuer=\"${COSIGN_CERTIFICATE_OIDC_ISSUER}\" \\\n    \"${CONTAINER_REGISTRY_IMAGE_NAME}@${MANIFEST_DIGESTS}\" | jq --color-output\ndone \u003c\u003c\u003c \"$(regctl manifest get \"${CONTAINER_REGISTRY_IMAGE}\" --format '{{jsonPretty .}}' | jq -r '.manifests[].digest')\"\n\ncosign verify-attestation --type=\"${COSIGN_ATTESTATION_TYPE}\" \\\n  --certificate-oidc-issuer=\"${COSIGN_CERTIFICATE_OIDC_ISSUER}\" \\\n  --certificate-identity-regexp=\"${COSIGN_CERTIFICATE_IDENTITY_REGEXP}\" \\\n  \"${CONTAINER_REGISTRY_IMAGE}\" | jq --color-output '.payload |= .[:2000] + \"...\u003crest_is_removed\u003e...\"' --color-output\n\ncosign verify-attestation --type=\"${COSIGN_ATTESTATION_TYPE}\" \\\n  --certificate-oidc-issuer=\"${COSIGN_CERTIFICATE_OIDC_ISSUER}\" \\\n  --certificate-identity-regexp=\"${COSIGN_CERTIFICATE_IDENTITY_REGEXP}\" \\\n  \"${CONTAINER_REGISTRY_IMAGE}\" | jq '.payload | @base64d | fromjson | .predicate' | grype\n\nfor PLATFORM in ${CONTAINER_IMAGE_PLATFORMS//,/ }; do\n  cosign download attestation --platform=\"${PLATFORM}\" --predicate-type=\"${COSIGN_ATTESTATION_TYPE}\" \\\n    \"${CONTAINER_REGISTRY_IMAGE}\" | jq -r .payload | base64 -d | jq .predicate | grype --add-cpes-if-none\ndone\n\ncosign verify-attestation --type=\"slsaprovenance\" \\\n  --certificate-oidc-issuer=\"${COSIGN_CERTIFICATE_OIDC_ISSUER}\" \\\n  --certificate-identity-regexp='^https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v[0-9]+.[0-9]+.[0-9]+$' \\\n  \"${CONTAINER_REGISTRY_IMAGE}\" | jq --color-output\n\nslsa-verifier verify-image --print-provenance --source-uri \"github.com/ruzickap/malware-cryptominer-container\" \\\n  \"${CONTAINER_REGISTRY_IMAGE}\" | jq --color-output\n\ncosign tree \"${CONTAINER_REGISTRY_IMAGE}\"\n```\n\n## Local tests\n\nContainer build:\n\n```bash\ndocker build . -t malware-cryptominer-container\n```\n\nRun container and download the malware file:\n\n```bash\ndocker run -it --rm -p 8080:8080 malware-cryptominer-container\n\ncurl http://localhost:8080/eicar/\n```\n\nDebug container:\n\n```bash\ndocker run -it --rm --entrypoint=/bin/sh --user root malware-cryptominer-container\n```\n\nRun in Kubernetes:\n\n```bash\nkubectl run malware-cryptominer --image=quay.io/petr_ruzicka/malware-cryptominer-container:3\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fruzickap%2Fmalware-cryptominer-container","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fruzickap%2Fmalware-cryptominer-container","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fruzickap%2Fmalware-cryptominer-container/lists"}