String obfuscation is trivial to do so I have a feeling they're actually running the binaries in order to do anything. Just a feeling, though- I don't think the author of the post stuck around long enough to see if the remote instance behaved as it should.