Cross-Platform Analysis of Script-Based Fileless Malware Using Memory Forensics
摘要
Fileless malware, a stealthy variant distinct from traditional threats, infiltrates systems without relying on files or executables. It operates within memory, evading detection by leaving no traces on the disk. Concealed scripts, embedded VBA/VBS scripts, Living off the Land Binaries (LOLBins), etc., are the legitimate tools exploited to execute malicious code discreetly. As fileless malware evolves, its reach extends beyond Windows to encompass Linux. While the core objective remains to inject malicious code into legitimate processes, the techniques used in both environments differ. Windows encounters manipulation of the Registry and PowerShell, while Linux faces attacks utilizing Bash scripts, kernel-level exploits, and memory injection. This study examines fileless malware employing script-based techniques in both Windows and Linux environments. Malware instances were obtained from Malware Bazar and analyzed using sandboxes and memory forensics tools to confirm their presence and behavior.