Malware
Elastic Security Releases BPFDoor Configuration Extractor Tool
Elastic Security has published a Python‑based extractor that pulls hard‑coded passwords from BPFDoor samples. The tool can be run in Docker or locally via Poetry and supports single files or directories. Defenders should run it against suspected BPFDoor binaries to recover credentials and improve incident response.
What Happened
Elastic Security released a command‑line tool that extracts embedded passwords from BPFDoor malware samples. The project includes a Docker image and a local Poetry‑based workflow.
How to Use
Docker is the recommended method. Build the image:
docker build . -t bpfdoor-extractorRun the container, mounting the directory that holds the samples:
docker run -ti --rm -v $(pwd)/binaries:/binaries bpfdoor-extractor:latest -d /binaries/Specify a single file with
-f or a directory with -d. For local execution, install Poetry, then:poetry lock poetry install poetry shell bpfdoor-extractor --help
Impact
Extracting hard‑coded credentials allows defenders to identify compromised accounts and reduce the blast radius of BPFDoor infections. The tool also facilitates automated scanning of large sample sets.
What to Do
Integrate the extractor into your malware analysis pipeline. Run it against any binaries flagged as BPFDoor or that exhibit suspicious behavior. Export the output to your SIEM or ticketing system for rapid containment.
Related articles
Elastic Security Labs Releases NETWIRE Configuration Extractor to Aid Detection
Elastic Security Labs has released a free tool that dynamically extracts encrypted configuration data from the NETWIRE RAT, a malware variant that has risen in prevalence since 2022. The extractor uses YARA and Capstone to locate RC4 keys and decrypt payloads, enabling defenders to expose C2 endpoints and credentials quickly.
Read briefing
GHOSTPULSE Evolves to Pixel‑Level Stealth – New Detection Requires Updated YARA
The latest GHOSTPULSE loader hides its encrypted configuration and payload inside PNG pixel data, replacing the old IDAT chunk method. Defenders should update Elastic Security YARA rules, use the new extractor, and monitor for single‑file executables that embed PNGs and for keyboard‑shortcut abuse in CAPTCHA flows.
Read briefing
QBOT V4 Banking Trojan: Execution Chain, Persistence, and New YARA Rule
Elastic Security Labs released a detailed analysis of QBOT V4, outlining its multi‑stage execution, dynamic persistence, and command‑and‑control mechanics. The report includes a YARA rule, a configuration extractor, and IOCs for defenders to deploy.
Read briefing
DOUBLELOADER Malware Uses ALCATRAZ Obfuscation – What Defenders Need to Know
Elastic Security Labs uncovered DOUBLELOADER, a backdoor that uses the ALCATRAZ obfuscator and ships with the RHADAMANTHYS infostealer. The malware injects into explorer.exe, gathers system data, and beacons to a hard‑coded IP. Defenders should scan for the .0Dev section, use de‑obfuscation tools, and block outbound traffic to the beacon address.
Read briefing