Malware › Module 4 › Lesson 4
Lab — Strings
Pack strings and hashing — sha256 log, strings workflow, IOC table — literacy file only, dest $MAL_LAB.
Visual · mal_strings_lab
Lab: write strings/hash pack. $MAL_LAB only. Original Cyberlium.
Opening
Hash and strings pack before YARA — fingerprints and candidates on paper first.
Lessons 4-1 through 4-3 covered sha256, strings, and IOC candidates. This lab merges them into one strings/hash pack for $MAL_LAB. Optional: compute sha256 of a legal training sample metadata hash from MalwareBazaar listing — no download required if offline. No detonation required — static IOC pipeline paperwork. Next: Quiz — Strings and Hashing.
1. Lab contract: write the strings/hash pack
Create $HOME/cyberlium-lab/t22-m04-l04-strings-lab.txt merging hash log template, strings workflow, IOC candidate table, and link to M3 static pack.
Optional: example IOC rows marked 'candidate/low' from public report hashes — no live sample needed.
Command guide
Try these commands — Lab contract: write the strings/hash pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Static IOC extraction — https://malwareunicorn.org/workshops/malwareanalysis101.html Hybrid Analysis strings tab — https://www.hybrid-analysis.com/ (report literacy) VirusTotal — https://www.virustotal.com/ (hash + string context)
═══ INSTALL ═══
Linux (Debian/Ubuntu): Built-in (binutils)
Command — copy this
sudo apt install openssl
macOS: Built-in
Windows: Use WSL or install binutils
Command — copy this
choco install openssl
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t22-mal/lab.env" 2>/dev/null || export LAB_MAL=$HOME/cyberlium-lab/t22-mal sha256sum "$HOME/cyberlium-lab/t22-mal/samples/"* > "$HOME/cyberlium-lab/t22-mal/notes/hashes.txt" strings "$HOME/cyberlium-lab/t22-mal/samples/eicar.com.txt" | tee "$HOME/cyberlium-lab/t22-mal/notes/eicar-strings.txt" grep -i eicar "$HOME/cyberlium-lab/t22-mal/notes/eicar-strings.txt"
Primary tools to practice this lesson: strings, openssl. Reference sites: Static IOC extraction (https://malwareunicorn.org/workshops/malwareanalysis101.html); Hybrid Analysis strings tab (https://www.hybrid-analysis.com/); VirusTotal (https://www.virustotal.com/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check unsafe IOC habits
Grep for host URL visits, live sample attachments, or block-everything language — fix. Tutorials that curl C2 from host get rewritten to $MAL_LAB sandbox confirmation steps.
Classmates write their own strings/hash packs.
3. Lock the proof
chmod 600 on the pack. Quiz next — then YARA Literacy.
IOC pipeline feeds YARA rule writing in Module 5.
4. What you ship: strings and hashing pack for $MAL_LAB
Hash log + strings workflow + IOC table merged. $MAL_LAB named. Safe sharing rules. chmod 600.
5. What you record before the next lesson
Date. Strings/hash pack path. $MAL_LAB named. File t22-m04-l04-strings-lab.txt chmod 600.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Visit C2 from strings on host. Share live sample with IOC table.
Right
Write YOUR strings/hash pack for $MAL_LAB. chmod 600. Next: Quiz — Strings and Hashing.
Mission: freeze YOUR strings/hash pack on disk
1) Merge M4 literacy sections. 2) Link M3 static pack. 3) chmod 600. Never include host C2 visits.
Stuck? Ask Cyberlium AI Mentor
Hash + strings + confidence = professional triage.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: IOC pack should include confidence labels.
True or False
Knowledge Check
APPLY: sha256 in pack is computed on:
Multiple choice