Identification of library functions statically linked to Linux malware without symbols

Many Linux malware have been found to have statically linked library functions. Much of this malware are stripped of function names and addresses, hindering function-level analysis. For function-level analysis, we identified library functions stically linked to 2,256 malware samples with the Intel 80386 architecture by matching patterns. The pattern matching identified more than 90% of the library functions for 97.7% of the samples. Thus, pattern matching can be effective for library identification. Only 12 toolchains had been used to build 99.8% of samples, and 11 of the toolchains are available on the Internet. The C library used by the malware was uClibc in 96.5% of the samples, musl in 1.3% and GLIBC in 2.0%.