Background
On April 24, 2019, our Unknown Threat Detection System highlighted a suspicious
ELF file which was marked by a few vendors as mining related trojan on VT. We
cannot confirm it has mining related module, but we do see it starts to perform
DDoS function recently.

The file itself is a Lua-based Backdoor, we named it Godlua Backdoor as the Lua
byte-code file loaded by this sample has a magic number of “God”.

Godlua Backdoor has a redundant communication mechanism for C2 connection, a
co

RIPE NCC Regional Meeting: 24-25 September 2019, Kiev, Ukraine