1

I recently downloaded an ELF file which was discovered from an exploit attempt (wget to download this binary failed due to outgoing traffic being blocked if it isn't whitelisted). I downloaded it into a VM in order to run some basic analysis on it and uploaded it to virustotal.

My question is, absent some sort of terrible vulnerability in how curl downloads files or how analysis tools handle the files, is there any danger to a binary simply being on your system, without it ever being executed?

Improve this question
1
  • 1
    Note that "terrible vulnerabilities" in analysis tools do exist. E.g., CVE-2016-4025.
    – Brian
    Commented Jan 16, 2020 at 22:58

1 Answer 1

Reset to default
2

Malware sitting quiescently on your system is not a danger in the sense that it can spontaneously do something. The risk is more along the lines of, "Don't Push The RED Button!"

The fact that it's there is an opportunity for mistakes. It could be a manual mistake of you inadvertently running it, or another program (like a Virus Scanner) finding it and taking some undesired action like auto reporting to superiors or technical response teams.

Malware can be handled safely but it needs to be handled carefully. Assume that it may be accidentally run and consider your response recovery. Purge the VM or hope you can eradicate it from your main system.

Improve this answer
1
  • There is also the possibility that the file could take advantage of a vulnerability in sometime like an antivirus system that may try to read over the file.
    – xorist
    Commented Jan 17, 2020 at 3:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .