Triage a binary you wrote, and stop when it stops mattering

short · 50 min · Objective 3.3

Task

Write a small program that behaves like an implant without being one, then triage it as though you had found it: static first, then dynamic, extracting indicators as you go -- and stop the moment further analysis stops changing the response.

Steps

  1. Write a small program that does four implant-like things and nothing harmful: reads its own hostname, writes a file to a temporary directory, contacts a fixed address on a timer, and prints an obviously fake identifier string. Compile it and strip the symbols.
  2. Static triage. Hash it. Run strings and record every URL, path and distinctive token. Check the file type against its extension, and look at its imported functions.
  3. Write down what you can already say about it from static analysis alone, and what you cannot.
  4. Dynamic. Run it with networking disconnected and record what it does. Then run it with the lab network on and capture the traffic.
  5. Extract indicators, ranked: the fixed address, the file path, the identifier string, the timing pattern. Note which survive a recompile with different values, and which do not.
  6. Stop. Write down the four things a responder needs -- network indicator, persistence mechanism, capability class, family if known -- and confirm you have them. Then state what further analysis would change, and whether that is worth the hour.

Verify

sha256sum /tmp/sample/implant
file /tmp/sample/implant
strings -n 6 /tmp/sample/implant | grep -cE "10\.10\.10\.|/tmp/"
tshark -r /tmp/implant.pcap -T fields -e ip.dst -Y "tcp.flags.syn==1" | sort -u
ls -la /tmp/implant-marker* 2>/dev/null | wc -l

The hash and file type are the identity. The strings count must be non-zero -- those are your static indicators, found without running anything. The capture must show the destination, and the marker file must exist, which together confirm the dynamic analysis observed both halves of the behaviour.

Notes

Note how much you learned from strings alone, and how quickly. Static triage is minutes and answers most of what a responder needs; the reflex to reach straight for a disassembler costs a day and usually changes nothing.

Now recompile with a different address and filename and re-run your indicator list against it. The hash and the strings are worthless; the timing pattern and the behaviour survive. That is the pyramid of pain, demonstrated on a sample you control.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.