Ezuri

A Simple Linux ELF Runtime Crypter. An unpacker by f0wl can be found at f0wl/ezuri_unpack.

Usage

Clone this repo, build with go build -o ezuri . and run ./ezuri executable.

References

• https://www.guitmz.com/running-elf-from-memory/
• https://github.com/guitmz/memrun
• https://cybersecurity.att.com/blogs/labs-research/malware-using-new-ezuri-memory-loader
• https://www.bleepingcomputer.com/news/security/linux-malware-authors-use-ezuri-golang-crypter-for-zero-detection/