Malware 1/3

Description

This challenge has been split into three independent steps, but the logical order is as follows: forensics (1) -> pwn (2) -> reverse (3).

/!\ Warning: the attached memory image contains a program that encrypts the file /home/%USER%/Desktop/flag.txt /!\

Oh no! Your precious file flag.txt on your desktop seems to have been encrypted by a malicious program… Your first reaction was to perform a memory dump, maybe the malware was still running…

Note: the flag follows the format FCSC{sha256(username:hostname:cmdline)}, where username is the name of the user who ran the malware, hostname is the name of the machine on which it has been executed and cmdline is the complete command line that was executed to run the malware.