What they actually installed
A payload uploaded to an exposed server after a successful login. It is UPX packed, so its contents stay hidden until it is unpacked. Unpacked, the strings identify it immediately as a Monero miner.
They broke in and installed a Monero miner. Here it is.
This file was uploaded to a server of mine minutes after someone guessed the root password. Two megabytes, no readable text inside, nothing that tells you what it does. That is deliberate.
It is packed with UPX, a compressor that wraps an executable so its contents stay hidden until it runs. Unpacking is one flag, and the file more than doubles to five megabytes. Now the strings talk. RandomX, the algorithm Monero uses. And the coin itself, spelled out. It is a miner, installed to sell my processor without asking.
The file never ran here. Unpacking and reading strings is static, and it turns an anonymous blob into a clear answer in about ten seconds.
Packed does not mean unreadable. It means one step away.
#linux#security#malware#sysadmin#selfhosting
❯ Packed does not mean unreadable. It means one step away.