Lion Cipher Lab
Triage a malware sample's strings with a local LLM — then verify what it tells you
- AI Security
- Intermediate
- ~60 min
- Free · no account required
Why it matters
When a suspicious file lands on your desk, one of the fastest first moves is to pull its human-readable strings — URLs, registry keys, API names, a mutex, a config blob — because they hint at what the thing does before you ever run it. But a raw dump of hundreds of strings is a wall of noise, so the obvious 2026 move is to paste it into a language model and ask 'what is this?' That genuinely works as a triage draft: the model groups the mess into C2, persistence, anti-analysis and capabilities in seconds, and explains an API you have never seen. The trap is that a language model is a text…
What you'll learn
- extracting strings safely from a binary with strings and FLOSS (including obfuscated/stack strings)
- using a local LLM (via Ollama) to triage extracted strings into C2, persistence, anti-analysis and capability buckets
- mapping suspicious Win32 API names to likely behaviour and verifying against Microsoft's own documentation
- confirming or refuting a model-claimed IOC against the raw strings
- verifying LLM-suggested MITRE ATT&CK technique IDs actually exist
- measuring how many of a model's claims survive verification
- judging when strings triage by LLM helps and when strings lie (packing, planted false flags)
- why a real sample's contents must never go into a hosted/cloud LLM
Steps in this lab
- What strings are, and why they are the fast first look — and its limits
- Get strings SAFELY — the graded path never runs live malware
- See real extraction: strings and FLOSS on a benign binary
- Install Ollama and a small local model — and why local is non-negotiable here
- Triage the strings with the model — group, explain APIs, flag IOCs
- Verify claim 1 — do the APIs mean what the model says? Check Microsoft's docs
- Verify claim 2 — is each 'IOC' actually in your strings? Catch the invention
- Verify claim 3 — do the ATT&CK IDs exist? Then measure what survived
- The judgment: when to trust strings triage by LLM — and when it lies to you