A Portable Executable (.EXE), ELF64 and HTML polyglot that runs natively on Windows, Linux and in the Browser.
  • jokro@feddit.org
    2 months

    Wow, in case it’s not clear, it really is the same file for all three platforms.

  • Die Mart Die@sh.itjust.works
    2 months

    This is pretty cool. Reminds me of .kkrieger, but this beats it in small size and that it’s a polyglot (though .kkrieger wins in visuals)

    I didn’t see a link to source code for the snake tho

    • TeamAssimilation@infosec.pubEnglish
      2 months

      I’d guess the former, given it’s tiny compared to normal droppers, but you can never be sure these days.

      This sample is a multi-platform ‘polyglot’ binary acting as a dropper and potentially a browser-based exploit. It functions as a Windows PE (with no standard imports, suggesting custom shellcode or manual API resolution), a Linux shell script, and an HTML/JavaScript file. The Linux component contains a command (‘tail -c+4294 $0 | lzma -dc > /tmp/a’) that extracts and executes a hidden payload from its own body. The embedded JavaScript is obfuscated and uses ‘eval’ to execute dynamically generated code. This structure is typical of sophisticated malware or cross-platform exploit delivery kits.