Benign iot-malware Download

su.c

Accesses argv[0] (Self path)User information fingerprinting

SHA-2560fe7e7724296ff0c405f24d27becd4cd7c3eb216f600b5c2d8be85f2375adb7f

Evidence

Accesses argv[0] (Self path) lines 63–65

if (argv[0] && LONE_DASH(argv[0])) {
flags |= SU_OPT_l;
argv++;

Get login name lines 79–89

79#if ENABLE_FEATURE_UTMP
old_user = user_buf;
if (getlogin_r(user_buf, sizeof(user_buf)) != 0)
82#endif
{
	pw = getpwuid(cur_uid);
	old_user = pw ? xstrdup(pw->pw_name) : "";
}
tty = xmalloc_ttyname(2);
if (!tty) {
	tty = "none";

Password getter or checker lines 96–98

if (cur_uid == 0 || ask_and_check_password(pw) > 0) {
if (ENABLE_FEATURE_SU_SYSLOG)
	syslog(LOG_NOTICE, "%c %s %s:%s",