Summary
We have pcapng file and 5 questions to answer:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
Q1. Sunt accesate 2 platforme de social media de catre malware. Care sunt acestea?
OSC{nume.domeniu,nume.domeniu}
Q2. Care este adresa IP a C2-ului?
OSC{adresaip}
Q3. Identificați numărul pachetului care contine transferul fisierului/payloadului adițional descarcat de malware.
OSC{string}
Q4. Care este arrival time in pachetul ce contine fisierul .rar?
Format: OSC{epochtime}
Q5. Ce "motiv" primeste C2-ul astfel incat sa autorizeze descarcarea malware-ului pe computerul infectat?
OSC{string}
Q6. Care este numele cheat-ului folosit pentru roblox?
OSC{string}
Solution
Q1
While inspecting the HTTP requests, I observed connections to two well-known social media platforms:
Host: facebook.com and Host: x.com
Answer:
OSC{facebook.com,x.com}
Q2
I navigated to Statistics → Conversations → IPv4. The IP 147.45.44.42 sent 18,587 packets – an unusually high volume indicative of C2 activity. Additionally, packet 69986 contains the file Tricky.rar, which is sent by this same host, So this is cleary the C2 server.
Answer:
OSC{147.45.44.42}
Q3
The malicious .rar payload is downloaded in packet number 69986. This can be verified via File → Export Objects → HTTP Objects.
Answer:
OSC{69986}
Q4
In packet 39758, wich contains the .rar fil, the exact Epoch arrival time is recorded.
Answer:
OSC{1735330355.624480000}
Q5
By using File → Export Objects → HTTP Objects, the following request is found in packet 39817:
1
GET /?reason=d29ya2VyNTk5Y2htZWw=:aWxvdmVpdA==
The reason parameter contains two Base64-encoded values. Decoding them from base 64 we get the flag.
Answer:
OSC{worker599chmel:iloveit}
Q6
Packet 1106 contains a PNG image named solara.png. We can guess this is the roblox cheat but after we extract the file, the image is the logo of a Roblox cheat. The cheat name is: solara
Answer:
OSC{solara}