1

I recently downloaded an ELF file which was discovered from an exploit attempt (wget to download this binary failed due to outgoing traffic being blocked if it isn't whitelisted). I downloaded it into a VM in order to run some basic analysis on it and uploaded it to virustotal.

My question is, absent some sort of terrible vulnerability in how curl downloads files or how analysis tools handle the files, is there any danger to a binary simply being on your system, without it ever being executed?

1
  • 1
    Note that "terrible vulnerabilities" in analysis tools do exist. E.g., CVE-2016-4025.
    – Brian
    Jan 16 '20 at 22:58
2

Malware sitting quiescently on your system is not a danger in the sense that it can spontaneously do something. The risk is more along the lines of, "Don't Push The RED Button!"

The fact that it's there is an opportunity for mistakes. It could be a manual mistake of you inadvertently running it, or another program (like a Virus Scanner) finding it and taking some undesired action like auto reporting to superiors or technical response teams.

Malware can be handled safely but it needs to be handled carefully. Assume that it may be accidentally run and consider your response recovery. Purge the VM or hope you can eradicate it from your main system.

1
  • There is also the possibility that the file could take advantage of a vulnerability in sometime like an antivirus system that may try to read over the file.
    – xorist
    Jan 17 '20 at 3:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.