Memosyne

Hm, I possibly misused the term "amateurish" when I meant "simple". My apologies for the confusion.

I'm not denying its effectiveness, just remarking on its technical merit as a topic of discussion. Once the system is already compromised it becomes less about the payload and more about the attack vector involved. If the payload in question was using novel techniques then it would be a different story but the analysis shows the program to be relatively rudimentary.

> Each sample of the malware contains a hardcoded name of the victim organization.

> Apart from encrypting the files and leaving ransom notes, the sample has none of the additional functionality that other threat actors tend to use in their Trojans: no C&C communication, no termination of running processes, no anti-analysis tricks, etc.

> Curiously, the ELF binary contains some debug information, including names of functions, global variables and source code files used by the malware developers.

Seems pretty amateurish...

If you have colorful icons you'll need to duplicate the resources to account for light and dark variants unless you prefer sub-optimal legibility. If you emphasize color as a method of representing state you'll need to adjust by shipping images for each state value. With monochrome icons the emphasis is placed on shape so you can efficiently render the whole icon in a different color without obfuscating its meaning.