A config block found by its byte pattern

A Linux botnet stores its configuration after a fixed four-byte marker and a two-byte length. Use a hex rule with wildcards to find which binaries carry it and at which offset.

Terminal mission
Intermediate
4 objectives
0 of 4 solved

Briefing

Reverse engineers found that this botnet’s binaries keep their config after the bytes C0 F1 6E 00, followed by a two-byte length that changes per build, then 01 00.

Hex strings in YARA match raw bytes, and ?? matches any single byte. yara -s prints each hit with its offset, which tells a reverse engineer where to start.

analyst@detect-lab

detect-lab · YARA triage

Type help for the command list and objectives for your tasks. Everything runs in this browser.

analyst@detect-lab:~$

Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.