Week 12: Malware Analysis Lab: Can You Identify This Malware?

Can You Identify This Malware? Time: 60–90 minutes Difficulty: Intermediate Skills: BASH CLI, Python Scripting, Applied Cryptography, Encoding Schemes, Linux File Permissions A Horror Story First In 2022, a security team at a cloud storage provider discovered an anomaly in their server logs. A file had been uploaded through a legitimate API endpoint — nothing in the filename, content-type header, or file size triggered any automated alerts. The file sat quietly on disk for eleven days. Then a scheduled job — one that processed uploaded files — picked it up, decoded it, and executed it. Within ninety seconds the server had exfiltrated SSH private keys for every user account on the host to an external server registered under a convincingly generic domain name: something indistinguishable from a Linux software update mirror. The attacker never exploited a CVE. They never brute-forced a password. They uploaded a file and waited. The vulnerability was that the server trusted the content of