e375c49afea5938bca1dc32f44ecdf52df5439cf5a83716bae7f71efc7653a86
|
struppigel
|
easy
|
|
Figure out which files are infected by this virus. Which software does it target?
|
—
|
|
0
|
09 Oct 2026
|
75da9dfe4d0ef6db1d68533ef66a70d4c26230fc82e50e6428f4931800f7b3b2
|
0xca5ade19a931
|
medium
|
|
This sample is a second stage payload shellcode extracted from a loader. The goal is to understand its API hashing algorithm and to decrypt the third-stage payload. In addition tampering with security products as evasion techniques can be identified. How is the third-stage payload executed?
|
1
|
|
1
|
27 Sep 2026
|
c4750651611e913c3d83e85cfaa90b791da2bf37cbe3c62660877323ee9c6e52
|
struppigel
|
easy
|
|
Figure out how to recover a system infected by this malware without reinstalling the operating system. What permanent changes are done to the system? Which of these make the system unbootable?
|
—
|
|
0
|
24 Sep 2026
|
d2e98409dca36f58a4b71d631ea941bb5f5153ece976935e95a09764cc6a98f9
|
struppigel
|
easy
|
|
Figure out the password of this screenlocker and check if there are any other ways than the password to get out of it.
|
1
|
|
0
|
24 Sep 2026
|
9c692a0bf6d9d784e705dbd5f8fe8089d31eeab6fe196f9288573fd4aa3c5fa6
|
0xca5ade19a931
|
medium
|
|
Extract the payload and describe how it is executed. List the different evasion techniques that are implemented. What encryption and hashing algorithms do you encounter?
|
1
|
|
0
|
21 Sep 2026
|
bb35048b13c65e89ea00df97518a341404281bb7fe04cf095243c8e32ebd7da5
|
struppigel
|
medium
|
|
Use hooking to figure out the malware type and the C2 server.
|
1
|
|
0
|
06 Sep 2026
|
5a26fd462a809c89b0448318591cb98a77a7b96fca658815dc0f547a51958bed
|
fs-0xC0
|
medium
|
|
document infection chain loading LxBase RAT, extracting it's configuration and unveiling functionality using decrypted strings
|
1
|
|
0
|
03 Aug 2026
|
4ada609d908afd3bb171ab8287cd2ada2cf112c80c9786e10441d68d979caa4c
|
struppigel
|
medium
|
|
Deobfuscate the sample.
How does the domain name generation work?
How does this sample receive and execute code from the attacker?
|
2
|
|
0
|
19 Jun 2026
|
db5d284b9a9c02f76030ba89fd85c7c8f830f8fe4195cdc1f9cddf15f127125d
|
struppigel
|
medium
|
|
Deobfuscate the strings and markup the code of this rootkit. What exactly can it hide?
|
1
|
|
0
|
13 Jun 2026
|
478d992c999a0e93ada1c9aa10644e3abdc207d407492c5bc2710986de4d42be
|
struppigel
|
easy
|
|
Where does this office document get the next stage and how?
When was the document created?
|
3
|
|
0
|
25 Apr 2026
|
060ed0ec27a0a4ad7b55425ed56d8ef0c55aa61b499d4884d1679f18d518ddf3
|
struppigel
|
medium
|
|
Find the two webhooks of this stealer and determine the persistence mechanisms.
|
1
|
|
0
|
23 Mar 2026
|
57e497bf62138b926d4adab395e0ab64f9f1b606ff9219e0c004fcc5a8348f7a
|
struppigel
|
medium
|
|
Find the code that is responsible for loading the next stage. Figure out the download URL for the next stage with emulation.
|
—
|
|
0
|
17 Mar 2026
|
49660527c1c910ad2d3c5625c1b44682e465e45b65883dfc8d7d229d1bd0ebd8
|
struppigel
|
advanced
|
|
Extract the main.js, decompile and deobfuscate it so far that you can see the webhook
|
1
|
|
0
|
07 Mar 2026
|
b0e365c603013751085946ff0500f7d8c0e3c106d3b02c368c2f267279660a6d
|
struppigel
|
medium
|
|
Write a configuration extractor for this loader
|
1
|
|
0
|
28 Feb 2026
|
161f2a6ecf64dcbbc1616d536cb2ed2e53afc5a4f5deca810b0f55cc82a6b447
|
malwarecakefactory
|
medium
|
|
for RE learning
|
1
|
|
1
|
22 Feb 2026
|
95a636c2b3af0bc69cc05f7b32281ff17c58cbe637bec5f8918f7514a5f37e09
|
struppigel
|
easy
|
|
Check out the LNK in this archive. It downloads malware. How does it achieve that?
|
2
|
|
0
|
21 Feb 2026
|
465dc7a1068d0c7d31b4ffb0a013a59ddd0320dde4389748eed99f41ee0f51ae
|
struppigel
|
medium
|
|
How does this rootkit hide loaded modules of a process? Locate the function that is responsible for that. What's necessary to trigger the module hiding?
|
—
|
|
0
|
21 Feb 2026
|