The program that no longer exists
Deleting the executable immediately after starting it is standard behaviour for anything that does not want to be analysed: the process keeps running while the file is gone before anyone looks. The process list still reports the path it was started from, and that directory is empty. The kernel, however, keeps a link to the executable for as long as the process lives, and that link still resolves - it names the original path and marks it deleted. Unlinked is not destroyed. Reading through that link copies the binary back out byte for byte, ready to hash or analyse, with nothing installed and no forensic toolkit involved. The one irreversible mistake is killing the process first: the last reference goes with it, and only then is the file actually gone.
The program running right now does not exist on disk.
Deleting itself after starting is a standard move for anything that does not want to be looked at. The process keeps running, and the file is gone before you get there.
The process list still shows it, along with the path it was started from. Go to that directory and there is nothing in it.
But the kernel keeps a link to the executable for as long as the process is alive, and that link still resolves. It names the original path and marks it deleted. Unlinked is not destroyed.
So you can copy it straight back out. Read through that link and the binary lands in a file again, ready to hash or analyse. The one thing not to do is kill the process first, because that is when it really goes.
Before you kill anything suspicious, copy its executable out first.
#linux#security#selfhosted#infosec#sysadmin
❯ Before you kill anything suspicious, copy its executable out first.