Malware Triage: Hash It, Then Pull the IOCs
HardDigital Forensics & Incident Response25-40 minA suspicious sample was pulled off a compromised host and dropped in /root/case/sample/. Triage it statically — do not execute it — and produce the three things an analyst hands off first.
(1) The SHA-256 of the sample (for threat-intel lookup and as an IOC) → /root/case/answers/sha256.txt.
(2) The embedded C2 address — pull it from the sample's strings (it's in the BEACON_URL) → /root/case/answers/c2.txt.
(3) The malicious drop/persistence path it embeds — and don't mistake it for the benign CONFIG_PATH (a real CA bundle) the sample also references → /root/case/answers/dropped.txt.
The sample is a real ELF with an attacker overlay appended (how many trojanized/packed samples look). strings, sha256sum, and readelf are all you need. See /root/case/brief.txt.
- Hash a sample for threat intel without executing it
- Extract the C2 indicator from the sample's strings
- Identify the malicious drop path and distinguish it from a benign referenced path
Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.