Static analysis of PhantomRing — a stealthy Linux post-exploitation agent built to slip past EDR syscall monitoring and erase itself. Full writeup sealed until the Sherlock retires.
Our SOC intercepted a suspicious binary during a threat-hunting sweep of a Linux server — an
oddly-named file in /var/tmp making outbound connection attempts. It has the shape of a
post-exploitation agent. The brief is static analysis only: identify the binary's
capabilities, pull indicators of compromise, and map the operator's infrastructure without
detonating it in a way that phones home.
The challenge ships as a password-protected archive; unzipping it yields a single ELF named
agent. The first two tasks below — the file hash and the hardcoded C2 address — are the
low-sensitivity IOCs; the deeper capability analysis stays sealed until the Sherlock retires.
Before answering anything specific, we fingerprint the file and dump its printable strings — static analysis of a small agent like this lives almost entirely in its string table.
┌──(tameen㉿tameenoffsec)-[~/…/sherlocks/PhantomRing/phantom_ring]
└─$ file agent
agent: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked,
interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=1f617f2ea259a7ec724d7bbc01627982dc2f0495,
for GNU/Linux 3.2.0, not stripped
A dynamically-linked, not stripped x86-64 PIE — good news, symbol and function names
survive. From here strings agent is our primary lens.
Answer:
2d7b1b2178f76c26893b2a56cbf9b36700235259e76b893d53817d5b66b634a5
The first IOC to record is the file hash, so the sample can be tracked and shared.
└─$ sha256sum agent
2d7b1b2178f76c26893b2a56cbf9b36700235259e76b893d53817d5b66b634a5 agent
Answer:
192.168.56.1
A hexdump is too noisy to read by eye, so we grep the strings for anything resembling a URL or host, then for an IPv4 pattern directly. Only one address comes back, so it's safe to treat it as the hardcoded C2.
└─$ strings agent | grep -Ei "http|https|://|\.com|\.net|\.org|\.local"
.comment
└─$ strings agent | grep -E -o "([0-9]{1,3}\.){3}[0-9]{1,3}"
192.168.56.1
EMBARGOED — ACTIVE SHERLOCK
Sealed tasks
+4 more sealed
Why it's sealed: this Sherlock is still active on HackTheBox. Publishing a writeup for an un-retired Sherlock breaks their Terms of Service, so the full writeup unlocks only when it retires.
Rooted it already? Enter the access key for early access.