First Look: Pull the IOCs Out of an Unknown Binary with strings

A binary labeled a "backup helper" (/opt/backup/storagesyncd) was pulled off a host that had been beaconing. Before you disassemble or run anything, do the cheapest, safest first pass every analyst does: static string triage. Real samples leave configuration and indicators as plain text baked into the file — hard-coded C2 addresses, install paths, campaign tags — and strings surfaces them without executing a single instruction.

Do NOT run the sample. Extract its embedded indicators and record them under /root/case:

1. c2.txt — the command-and-control host (the IP only, no port).

2. persist.txt — the persistence path the sample installs.

3. campaign.txt — the campaign / build id string.

file /opt/backup/storagesyncd confirms it's an ELF; strings dumps its printable text. The intruder's config lines are prefixed SGCFG: — pipe strings to grep to filter them out of the binary's own noise. Grading re-extracts each value from the sample and compares it to what you recorded, so a guess won't pass — it has to come from the binary.