TF-MAL-elf.godlua
📛 Threat Title
Malware family: Godlua
Description
ThreatFox malware family `elf.godlua`. Printable name: Godlua.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
elf.godlua
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.godlua
IOC database
- Type
- domain
- Value
elf.godlua- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-elf.godlua
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.godlua
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:alpha-cyber.com
Strengthen Defense: Understanding the malware's infrastructure empowers your security team to implement targeted countermeasures and reduce risk. Protect Your Business from Emerging Threats GodLua's use of DNS over HTTPS allows it to bypass many perimeter defenses, increasing the risk of data breaches and service disruptions.
-
web:archive.orkl.eu
Godlua ( Malware Family ) By Fraunhofer FKIE Archived: 2026-04-05 21:44:12 UTC elf. godlua (Back to overview)
-
web:arxiv.org
Interpretable models are especially important in ad-versarial domains such as malware analysis, where understanding the rationale behind a classification can guide remediation efforts and enhance model robust-ness. This paper proposes a novel approach for detect-ing and explaining concept drift in malware families over time.
-
web:blog.netlab.360.com
The following is a comparison. Godlua Backdoor Reverse Analysis version 201811051556 This is the version we found earlier (201811051556). It focuses on the Linux platform and supports two kinds of C2 instructions, to execute Linux system commands and to run custom files. Sample information MD5: 870319967dba4bd02c7a7f8be8ece94f
-
web:malpedia.caad.fkie.fraunhofer.de
Details for the Godlua malware family including references, samples and yara signatures.
-
web:openhunting.io
Opensource Threat Hunting & Intelligence (Qihoo 360) The file itself is a Lua-based Backdoor, we named it Godlua Backdoor as the Lua byte-code file loaded by this sample has a magic number of "God". Godlua Backdoor has a redundant communication mechanism for C2 connection, a combination of hardcoded dns name, Pastebin.com, GitHub.com as well as DNS TXT are used to store the C2 address ...
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.linkedin.com
Tracking GodLua : Mapping DNS-over-HTTPS Malware The GodLua malware is a sophisticated threat abusing DNS-over-HTTPS (DoH) to stealthily communicate with its command-and-control servers ...
-
web:www.ncsc.gov.uk
How to defend organisations against malware or ransomware attacks.
-
web:www.pcrisk.com
Quick menu: What is Godlua ? STEP 1. Manual removal of Godlua malware . STEP 2. Check if your computer is clean. How to remove malware manually? Manual malware removal is a complicated task - usually it is best to allow antivirus or anti- malware programs to do this automatically. To remove this malware we recommend using Combo Cleaner Antivirus ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.