Nasty Propose Change

According to its author, this is a x64 ELF infector written in Assembly that implements the Reverse Text Segment Infection technique. Segment is extended in reverse by PAGE_SIZE to make room for the virus. This technique only works on regular ELF executables (does not work with PIE). It is also not working on systems with huge pages enabled at this time. PAGE_SIZE alignment should be calculated dynamically but this code assumes its value of 4096 for demonstration purposes. Infects current directory (non recursively) and has no destructive payload. Entry point still resides in the .text segment, which is less suspicious.

References

There is no Yara-Signature yet.