Public
- Public
- Network
- Groups
- Popular
- People

Conversation

Notices

Aral Balkan (aral@mastodon.ar.al)'s status on Monday, 14-Aug-2023 14:57:08 JST Aral Balkan
in reply to
- Paul
@paul 👌🤣

In conversation about a year ago from mastodon.ar.al permalink
- Paul (paul@fedi.nlpagan.net)'s status on Monday, 14-Aug-2023 14:57:18 JST Paul
  
  #linux #virus #lol
  In conversation about a year ago permalink
  Attachments
  1. By Roman Sharkov San Downloaded a virus for Linux lately and unpacked it. Tried to run it as root, didn't work. Googled for 2 hours, found out that instead of /usr/local/bin the virus unpacked to /usr/bin for which the user malware doesn't have any write permissions, therefore the virus couldn't create a process file. Found patched . configure and .make files on some Chinese forum, recompiled Tem Cee The virus said it needs the library cmalw-lib-2.0. Turns out cmalw-lib-2.0 is shipped with CentOS but not with Ubuntu. Googled for hours again and found an instruction to build a .deb package from source. The virus finally started, wrote some logs, made a core dump and crashed. After 1 hour of going through the logs | discovered the virus assumed it was running on ext4 and called into its disk encryption API. Under btrfs this API is deprecated. The kernel noticed and made this partition read-only. Opened the sources, grep'ed the Bitcoin wallet and sent $5 out of pity.
    https://media-akkoma-fedi-nlpagan-net.ilja.space/media/95eeed9c-a1f0-4ef9-ae79-228ff42258a7/virus.jpg

Feeds