3 ms·
Anyone have a copy of it that I can poke at in a virtual machine?
by heavyset_go 1y ago
Anyone have a copy of it that I can poke at in a virtual machine?
- techjamie 1y agoYou might be able to poke at the PKGBUILD on the wayback machine and see if the original sources work.
- mzajc 1y agoThe PKGBUILDs are not archived, but the package page does helpfully list its sources, one of which is https://github.com/danikpapas/zenbrowser-patch.git https://github.com/danikpapas/zenbrowser-patch.git (same for all three packages). I would assume that's where the malware is, but I couldn't find an archive. Does https://www.gharchive.org/ https://www.gharchive.org/ keep this sort of data? ETA: According to a Reddit post linked elsewhere in this thread, the payload was a binary file downloaded by a python script in the repository. It has been uploaded to VirusTotal, but downloading requires a premium subscription according to their docs: https://www.virustotal.com/gui/file/d9f0df8da6d66aaae024bdca26a228481049595279595e96d5ec615392430d67 https://www.virustotal.com/gui/file/d9f0df8da6d66aaae024bdca...