================================================================================
  STRINGS EXTRACTION OUTPUT — CTF Blue Team Lesson 03
  Malware Detection & Classification
================================================================================
  SAFETY NOTE: This file contains simulated strings output for training
  purposes only. No actual malware code is included.
================================================================================
  Source File:    svchost_update.exe
  Tool:          strings -n 6 svchost_update.exe
  Total Strings: 847 extracted (showing selected output below)
================================================================================

--- STANDARD WINDOWS API REFERENCES (may appear in legitimate software) ---

kernel32.dll
ntdll.dll
advapi32.dll
user32.dll
ws2_32.dll
GetProcAddress
LoadLibraryA
LoadLibraryW
GetModuleHandleA
GetSystemDirectoryA
GetTempPathA
GetWindowsDirectoryA
GetVersionExA
CreateFileA
ReadFile
WriteFile
CloseHandle
ExitProcess
GetLastError
Sleep
GetTickCount
SetFileAttributesA
CopyFileA
DeleteFileA
MoveFileExA
FindFirstFileA
FindNextFileA

--- NETWORK-RELATED STRINGS ---

WSAStartup
socket
connect
send
recv
gethostbyname
inet_addr
closesocket
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetReadFile
wininet.dll
WinHttpOpen
WinHttpConnect
WinHttpSendRequest

--- SUSPICIOUS: PROCESS MANIPULATION APIs ---

CreateRemoteThread
VirtualAllocEx
WriteProcessMemory
OpenProcess
NtUnmapViewOfSection
ZwQueryInformationProcess
RtlCreateUserThread
VirtualProtectEx
ReadProcessMemory
NtWriteVirtualMemory
IsDebuggerPresent
CheckRemoteDebuggerPresent
NtQueryInformationProcess
OutputDebugStringA

--- SUSPICIOUS: COMMAND EXECUTION ---

cmd.exe /c del "%s" >> NUL
cmd.exe /c ping 127.0.0.1 -n 3 > NUL && del "%s"
powershell -enc JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHM
powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\update.ps1"
/c schtasks /create /tn "SystemHealthCheck" /tr "%s" /sc ONLOGON /rl HIGHEST
wmic process call create
wscript.exe //B //Nologo "%TEMP%\helper.vbs"
bitsadmin /transfer systemupdate /download /priority high

--- SUSPICIOUS: PERSISTENCE MECHANISMS ---

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
HKLM\SYSTEM\CurrentControlSet\Services
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA

--- SUSPICIOUS: C2 COMMUNICATION ---

http://c2.badactor.xyz/beacon
http://c2.badactor.xyz/upload
http://c2.badactor.xyz/cmd
http://c2.badactor.xyz/exfil
POST /gate.php HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Content-Type: application/x-www-form-urlencoded
Host: update-service.definitelylegit.com
http://185.234.72.19:8443/checkin
https://pastebin.com/raw/Xk9mQ7pL
GET /config.bin HTTP/1.1

--- SUSPICIOUS: ENCODED/OBFUSCATED DATA BLOCKS ---

TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAGAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9
Z3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLg0NJAAAAAAA

aHR0cDovL2V2aWwtYzIuc2VydmVyLnh5ei9zdGFnZTIuZXhl

UEsDBBQAAAAIALRiY1kAAAAACgAAAA8AAAB0ZXN0X3BheWxvYWQudHh0
SwECFAAUAAAACAAAALRiY1kAAAAACgAAAA8AAAAAAAAAAAAAAAAAAAA

4d5a90000300000004000000ffff0000b800000000000000400000000000
0000000000000000000000000000000000000000000000f00000000e1fba

--- SUSPICIOUS: IRC CHANNEL REFERENCE ---

NICK bot_%COMPUTERNAME%
JOIN #malware-control
PRIVMSG #malware-control :CHECKIN|%COMPUTERNAME%|%USERNAME%|%OS%
PRIVMSG #malware-control :READY
PING :irc.undernet-servers.example.net
PONG :irc.undernet-servers.example.net
MODE #malware-control +s
PART #malware-control

--- FILE PATHS AND TEMP LOCATIONS ---

%TEMP%\svchost_update.exe
%TEMP%\update.ps1
%TEMP%\helper.vbs
%APPDATA%\Microsoft\Windows\svchost.dat
%PROGRAMDATA%\WindowsUpdate\config.ini
C:\Windows\System32\svchost.exe
%LOCALAPPDATA%\Temp\~DF4A2B.tmp
%USERPROFILE%\Documents\*.docx
%USERPROFILE%\Documents\*.xlsx
%USERPROFILE%\Documents\*.pdf
%USERPROFILE%\Desktop\*.docx

--- MUTEX / NAMED OBJECTS ---

Global\SvcHostUpdateMutex_7B2F
Global\WindowsSystemHealthCheck
Local\ShellExperienceHost_Mutex

--- ANTI-ANALYSIS STRINGS ---

vmware
virtualbox
vbox
qemu
sandboxie
wireshark.exe
procmon.exe
procexp.exe
ollydbg.exe
x64dbg.exe
ida.exe
SbieDll.dll
sbiedll.dll
wine_get_unix_file_name

--- MISCELLANEOUS ---

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
0123456789ABCDEF
[%04d-%02d-%02d %02d:%02d:%02d]
[INFO]  Beacon success
[ERROR] Connection failed, retry in %d seconds
[DEBUG] Payload size: %d bytes
Encrypted payload decrypted successfully
Config loaded from C2
Target acquired: %s
Exfiltration complete: %d files, %d bytes

================================================================================
  ANALYSIS NOTES
================================================================================
  Key indicators identified in strings output:
  1. Process injection APIs (CreateRemoteThread, VirtualAllocEx, WriteProcessMemory)
  2. C2 communication URLs (c2.badactor.xyz, 185.234.72.19:8443)
  3. Persistence via registry Run keys and scheduled tasks
  4. Anti-analysis/VM detection strings
  5. IRC-based C2 fallback channel (#malware-control)
  6. Base64-encoded data blocks (likely embedded payloads)
  7. Document file enumeration (*.docx, *.xlsx, *.pdf) suggesting data theft
  8. Self-deletion mechanism (cmd.exe /c del with ping delay)

  CHALLENGE: Categorize each string group by MITRE ATT&CK technique ID.
  Which strings would you use as IOCs for network-level detection?
  Which strings are too generic for reliable detection rules?
================================================================================
