So now that we have an idea of how to search our systems for a potentially malicious binary, let's focus on what we can do to gather as much information about the binary as possible. Like penetration testing, this is probably the most important phase of the methodology and will determine whether we set ourselves up for success or not. Assuming you know the name of the file in question, the types of information we want to gather and the questions we need to answer include the following:
- Is the file executable?
- Is the file a binary?
- For which architecture (x86, or x86_64) is the binary compiled?
- Which format is the binary? (Hopefully ELF, otherwise the rest of this book is going to be pointless.)
- Is the binary stripped of its symbol table?
- Can we identify any useful strings within the binary?
- Is there a running process associated with this binary?
- What...
