This scenario is similar to that of the previous chapter. A file has been written to one of our Linux servers and we're seeing some strange network activity from it, along with elevated processor and memory use compared to normal operation during the busy time of our business. Once again, I understand that we already know what this binary does based on the title of this chapter and, once again, I am asking us to use a little imagination as we dive into analyzing this binary. We'll also skip a few phases for the sake of brevity and we'll pretend we've already moved the file off of our server and onto our virtual machine for analysis.
As you may recall from the previous chapter, we created a Bash script to help to automate some of the initial phases of our binary analysis. Specifically, we designed a script to automate the information...