Deobfuscate the Config: Decode a Sample's Hidden C2

You did the strings first-pass and it came up thin — this sample hides its configuration. /opt/telemetry/telemetryd (pulled off a beaconing host, do NOT run it) carries its intruder config base64-encoded, not in the clear. strings shows a single opaque line SGCFG:b64=<blob>; the real C2 and stage-2 URL only appear once you DECODE that blob. This is the everyday reality of malware triage: obfuscation is the norm, so static analysis is strings PLUS a decode step.

Recover the config and record two indicators under /root/case:

1. c2.txt — the command-and-control host (the IP only, no port).

2. stage2.txt — the full stage-2 download URL (http://...).

Pull the blob with strings /opt/telemetry/telemetryd | sed -n 's/^SGCFG:b64=//p', then pipe it to base64 -d. Grading re-decodes the sample and compares, so recording the raw base64 (undecoded) will not pass — you have to decode it.