Randomize the homedir of the user to evade sandbox detection.
Open
Nobody has claimed this yet.
dynamic analysis
enhancement
needs discussion
- Dominant language
- Go
- Stars
- 912
- Forks
- 74
- PR merge metrics
- No merged PRs in 30d
Description
Some samples of malware check for a $HOME of /root and skip running if true.
Running at root has its advantages, so perhaps changing the home from /root to /home/${name}, where ${name} is replaced by a name drawn at random from a set of predefined common usernames (e.g. popular first names, admin, deploy, worker, etc)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files, tests, or entry points. Start by locating where the analysis environment sets the root user's HOME, then determine how randomized usernames and corresponding home paths should be represented; done means samples that reject /root can run while existing root execution remains available.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- operating-systems, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100