I found a file in my home directory named "sudo". It's 1.5GB in size and I have no idea where it came from.
-rw-r--r-- 1 foo foo 1598296064 Aug 9 11:22 sudo
Does anybody have any tips on how to proceed investigating this file? I fear that my computer may be compromised but I still want to know what I'm dealing with.
Here's what I've done so far:
file sudoshows `sudo: data'.
strings sudoshowed a large amount of random data.
which sudopoints to the sudo file in
If it's an executable binary I plan to run it but might transfer to a virtual machine before I do that. I have limited
gdb knowledge so at least I can inspect it.
which sudodoes not do anything with the file in the current directory named
sudoand will give that result from any folder. It just searches all of your different locations of your path and tells you which one it would use if you ran the
sudocommand right now.