I found a file in my home directory named "sudo". It's 1.5GB in size and I have no idea where it came from.
-rw-r--r-- 1 foo foo 1598296064 Aug 9 11:22 sudo
Does anybody have any tips on how to proceed investigating this file? I fear that my computer may be compromised but I still want to know what I'm dealing with.
Here's what I've done so far:
file sudoshows `sudo: data'.
strings sudoshowed a large amount of random data.
which sudopoints to the sudo file in
If it's an executable binary I plan to run it but might transfer to a virtual machine before I do that. I have limited
gdb knowledge so at least I can inspect it.