Loading malware…
Ezuri is an open-source Linux ELF runtime crypter and memory loader written in Go. Created by Guilherme Thomazi Bonicontro and released in 2019 as a research tool, it has been adopted by multiple threat actors to conceal malicious payloads and evade antivirus detection. Ezuri encrypts embedded payloads using AES in CFB mode, with the decryption key and initialization vector stored in the packed binary. Its execution stub decrypts the payload and uses the Linux memfd_create mechanism to execute it from an anonymous memory-backed file without writing the decrypted executable to disk.
TeamTNT has used Ezuri to pack Linux malware, including Black-T-associated payloads and Tsunami bots, in campaigns targeting cloud infrastructure and containerized environments, including Docker and Kubernetes. Ezuri provides packing and memory execution rather than the credential theft, cryptomining, or DDoS capabilities of the payloads it wraps. Packed samples have exhibited substantially reduced antivirus detection, although this does not guarantee that they are undetectable.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The group also began using a simple Linux ELF runtime crypter, ezuri, to encrypt their malware for evading detection.
5 distinct techniques documented for this family, organized by ATT&CK tactic.
According to a report released by AT&T Alien Labs, multiple threat actors are using Ezuri crypter to pack their malware and evade antivirus detection.
A Simple Linux ELF Runtime Crypter. An unpacker by f0wl can be found at f0wl/ezuri_unpack
The payload is encrypted with AES CFB and will be decrypted and run via memfd_create by the stub.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An open-source ELF crypter used by TeamTNT to encrypt and execute payloads from memory, primarily to evade detection.
An open-source Go tool previously leveraged by TeamTNT to load a fileless payload; it is cited only as historical comparison to PyLoose.
Linux ELF runtime crypter used by TeamTNT to encrypt malicious binaries and evade detection.
An ELF loader/crypter referenced as a comparative example of tooling that can be used to drop fileless ELF malware via memfd_create and help malware evade detection.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.