How to investigate an unknown 1.5GB file named "sudo" in my Linux home directory?

Question

I found a file in my home directory named "sudo". It's 1.5GB in size and I have no idea where it came from.

-rw-r--r--  1 foo foo 1598296064 Aug  9 11:22 sudo

Does anybody have any tips on how to proceed investigating this file? I fear that my computer may be compromised but I still want to know what I'm dealing with.

Here's what I've done so far:

• Running file sudo shows `sudo: data'.
• Running strings sudo showed a large amount of random data.
• Running which sudo points to the sudo file in /usr/bin/sudo

If it's an executable binary I plan to run it but might transfer to a virtual machine before I do that. I have limited gdb knowledge so at least I can inspect it.

Answer 1

You probably made it by accident with a botched shell command. I've done stuff like that myself. As a result it is probably filled with innocuous data. Here are a few reasons why I would guess it is not malicious:

1. 1.5 GB would be an extremely large virus. Since viruses are usually transmitted over a network, smaller is better.
2. It isn't executable.
3. Malware typically hides much better than this.
4. file thinks it is just a data file.

Of course none of that proves that it isn't malicious (a.k.a. viruses don't have to be small, just because it isn't executable doesn't mean it might not be part of a malicious payload, and sometimes they don't bother hiding), but I suspect this is harmless. This is probably too old, but I would see if your bash history goes to the day/time in question.

I realize I haven't given you any hints on how to analyze the file, but you've already hit the main helpers (file and strings), and they haven't helped! A file filled with random data from an errant command would explain what you are seeing, and likely has a better chance of generating a file named sudo in your home directory than malware does, IMO.

Answer 2

Does anybody have any tips on how to proceed investigating this file?

Since file doesn't recognize the "data" as an executable, it will be difficult to try to analyze dynamically (by running it) unless you can find the proper entry point.

Another standard Linux tool you could try is:

stat

This will give you a little more of the metadata information than what you can see with just the directory listing.

Another tool you could try is:

binwalk

which can provide analysis of binary files like firmware images. For example, if the binary file contains a file system binwalk may recognize it.

Yet another tool freely available on Linux is "The Sleuth Kit." If the binary file happens to be a raw disk image or file system data then you can try to process it with "The Sleuth Kit."

You could also try dropping the binary into IDA (the "Interactive Disassembler" from Hexrays--a freeware version is available) to see if IDA can make sense of it. But if file doesn't recognize it, I'm not too hopeful that IDA will.

Answer 3

I'd start with history | grep sudo from the terminal and look at the most recent sudo commands to see if any are malformed.

• It's your home directory.
• You haven't said it has special ownership so I'll assume you own it.
• It's almost certainly a botched shell command, so you probably made it from the terminal.
• It might be something created by a script but it's pretty rare to put "sudo" commands in a script.
• It's displaying itself openly and obviously so you probably would have noticed it if you hadn't created recently.

Answer 4

I think the other answers cover nearly everything already (and have already solved the mystery). One additional thing to try if you are still unsure about deleting it is to do a scream test. You won't necessarily get a resolution as to the source of the file, but you can have some confidence it is safe to remove.

Rename the file to something else and see if anything happens. Some things to look out for are

1. The file is recreated. That means something recent made it and it might be easier find out what through bash history or logs.
2. Something crashes. Depending how often programs crash this might be a red herring, but it might also be a hint as to the file's source.

Other methods to do a scream test would be to remove all access permissions so nobody can read or write to the file, or to corrupt the file.

EDIT

As Daniel points out, renaming the file won't work if process still has the file open. If the file is open you can see all open files with lsof, or you can find process id(s) of those processes which have the file open using fuser. ps will then give more information on the processes.

> fuser sudo
/home/bob/sudo:  3132  7070
> ps 3132 7070
  PID TTY      STAT   TIME COMMAND
 3132 ?        R    203:50 pdflatex
 7070 ?        Sl     0:45 evince

Answer 5

You could try "hexdump -C -n 512" to see if anything pops out at you in either the binary or ascii dump. It could be some mix of binary data and text data. Like a wget of a script that you mistyped, the hexdump might allow you to see some of the script.

Answer 6

You could go the plain old straightforward way: installing an antivirus and scanning the file. It's not a perfect solution, but it's a place to start and at least it would give you at least a little peace of mind about it.

I'm actually a bit surprised no one suggested this.

I'm not sure what distro you're on, but I'm sure there are plenty of antivirus solutions that would work. Off the top of my head, I would give ClamAV a try for something like this, seems easy to install.

Answer 7

You can also try head and see the first few lines of the file. The first few characters could reveal something about the file type. See magic number for more information.