szerintem ezt a gepet megtortek: nincs olyan csomag ubuntu focalban ami libdl.so-t a libseconf konyvtarba tenne:
https://packages.ubuntu.com/search?searchon=contents&keywords=libdl.so&…
valami idegen init-t tettek fel, csak jol elszurtak a libeket, es ezert nemtud betoltodni, a kernel meg panicol. -> reinstall.
szerk: https://www.joesandbox.com/analysis/480576/0/executive
a reszleteket nem tudom megnyitni, de a html kodban ilyen van:
Writes identical ELF files to multiple locations
Source: /usr/bin/cp (PID: 3517) File with SHA-256 96493303BA8BA364A8DA6B77FBB9F04D0F170CBECBC6BBACCA616161BD0F0008 written: /usr/lib/libseconf/.backup_ld.so Jump to dropped file
Source: /usr/bin/cp (PID: 3521) File with SHA-256 96493303BA8BA364A8DA6B77FBB9F04D0F170CBECBC6BBACCA616161BD0F0008 written: /usr/lib/libdsx.so Jump to dropped file
Writes ELF files to disk
Source: /tmp/32112 (PID: 3513) File written: /usr/lib/libseconf/libdl.so Jump to dropped file
Source: /usr/bin/cp (PID: 3517) File written: /usr/lib/libseconf/.backup_ld.so Jump to dropped file
Source: /usr/bin/cp (PID: 3521) File written: /usr/lib/libdsx.so Jump to dropped file
Executes commands using a shell command-line interpreter
Source: /tmp/32112 (PID: 3514) Shell command executed: sh -c "mkdir /lib/libseconf" Jump to behavior
Source: /tmp/32112 (PID: 3516) Shell command executed: sh -c "cp /lib/x86_64-linux-gnu/ld-2.31.so /lib/libseconf/.backup_ld.so" Jump to behavior
Source: /tmp/32112 (PID: 3518) Shell command executed: sh -c "ls -l /lib64/ld-linux-x86-64.so.2" Jump to behavior
Source: /tmp/32112 (PID: 3520) Shell command executed: sh -c "cp -p /lib/x86_64-linux-gnu/ld-2.31.so /lib/libdsx.so" Jump to behavior
Source: /tmp/32112 (PID: 3522) Shell command executed: sh -c "mv /lib/libdsx.so /lib/x86_64-linux-gnu/ld-2.31.so" Jump to behavior
Executes the "mkdir" command used to create folders
Source: /bin/sh (PID: 3515) Mkdir executable: /usr/bin/mkdir -> mkdir /lib/libseconf Jump to behavior
Hooking and other Techniques for Hiding and Protection:
[bar][index]
Drops invisible ELF files
Source: /usr/bin/cp (PID: 3517) ELF file: /usr/lib/libseconf/.backup_ld.so Jump to dropped file