Part two of my honeypot image analysis righteousit.wordpress.com/20… — shout out to @CraigHRowland and thanks again for the image @SecShoggoth!

Hudak’s Honeypot (Part 2)

This is Part 2 in a series. Part 1 is here. During my triage I noticed a suspicious file /var/tmp/dk86. It’s a 64-bit Linux ELF executable, owned by user “daemon”, created 2021-11…

righteousit.wordpress.com
2
7
1
19
Also you are correct - the Mozi files were created by me. I just forgot. 🤪
1
1
Replying to @SecShoggoth @CraigHRowland
Yeah, it didn’t seem likely to me that an attacker would be installing the UPX unpacker to look at the binary.

Dec 21, 2021 · 4:12 PM UTC

1
2
Replying to @hal_pomeranz @CraigHRowland
LOL. As you can see, I never initially meant for the honeypot to be released publicly so didn't keep it as pristine as I could have. :)