Linux Ransomware Analysis Reports

This dataset accompanies the paper “Systematic  Characterization of Linux Ransomware: Static Indicators, Dynamic Execution Patterns, and File Traversal Behavior.” It contains ELFEN sandbox analysis reports for 16 Linux ransomware families active between 2021 and 2025. Each family folder contains two subdirectories: Reports, which holds the full ELFEN JSON analysis report including static analysis results (ELF header, imports, strings, entropy, and CAPA capability detection) and dynamic behavioral data (file operations, network traffic, and dropped files); and ProcOPS, which holds the process operations JSON extracted from each  sample’s execution trace. Sample binary hashes are found in the JSON files.  Samples can be retrieved from VirusTotal or MalwareBazaar using these hashes.

Families covered: AbyssLocker, Akira, AvosLocker, Babuk, BrainCipher, Buhti, Cl0p, HellCat, IceFire, INCAPST_SU, MarioLocker, Monti, RansomEXX, REvil, 
TellYouThePass, Trigona.

Analysis environment: ELFEN sandbox on Ubuntu 22.10, Intel Core i7-10700, 16 GB RAM. All samples executed as x86_64 ELF binaries within Docker-containerised 
buildroot environments with eBPF-based kernel tracing.