Home / Labs / Hunt the Malware

Hunt the Malware

The attacker had root for 5 hours. Check /tmp for malware artifacts they may have dropped.

Open this lab

Commands practised here

• ls -la /tmp/Lists all files including hidden ones.
• cat /tmp/.cache/.updateReads the hidden dropper script.
• find /tmp -perm -4000 -type fFinds SUID binaries (run as root).

Nearby labs

• All labsBrowse the full list.
• Exam prepWhich exams these objectives map to.
• Triage the Logs
• Isolate the Host