e375c49afea5938bca1dc32f44ecdf52df5439cf5a83716bae7f71efc7653a86
|
struppigel
|
easy
|
|
Figure out which files are infected by this virus. Which software does it target?
|
—
|
|
0
|
09 Oct 2026
|
75da9dfe4d0ef6db1d68533ef66a70d4c26230fc82e50e6428f4931800f7b3b2
|
0xca5ade19a931
|
medium
|
|
This sample is a second stage payload shellcode extracted from a loader. The goal is to understand its API hashing algorithm and to decrypt the third-stage payload. In addition tampering with security products as evasion techniques can be identified. How is the third-stage payload executed?
|
1
|
|
1
|
27 Sep 2026
|
c4750651611e913c3d83e85cfaa90b791da2bf37cbe3c62660877323ee9c6e52
|
struppigel
|
easy
|
|
Figure out how to recover a system infected by this malware without reinstalling the operating system. What permanent changes are done to the system? Which of these make the system unbootable?
|
—
|
|
0
|
24 Sep 2026
|
d2e98409dca36f58a4b71d631ea941bb5f5153ece976935e95a09764cc6a98f9
|
struppigel
|
easy
|
|
Figure out the password of this screenlocker and check if there are any other ways than the password to get out of it.
|
1
|
|
0
|
24 Sep 2026
|
bb35048b13c65e89ea00df97518a341404281bb7fe04cf095243c8e32ebd7da5
|
struppigel
|
medium
|
|
Use hooking to figure out the malware type and the C2 server.
|
1
|
|
0
|
06 Sep 2026
|
161f2a6ecf64dcbbc1616d536cb2ed2e53afc5a4f5deca810b0f55cc82a6b447
|
malwarecakefactory
|
medium
|
|
for RE learning
|
1
|
|
1
|
22 Feb 2026
|
1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f
|
struppigel
|
advanced
|
|
Create a static C2 extractor that uses abstract syntax tree transformations with Babel. You can use astexplorer.net as helper tool.
|
1
|
|
0
|
13 Jan 2026
|
2299ff9c7e5995333691f3e68373ebbb036aa619acd61cbea6c5210490699bb6
|
struppigel
|
medium
|
|
Create a C2 extractor using a Python script, binary refinery pipeline or CyberChef recipie
|
1
|
|
0
|
11 Jan 2026
|
cb21368467bdf0ca8a4cd458f54d684e10da2d43a9c7285e094d39bdc410fb10
|
struppigel
|
medium
|
|
Unpack the payload and extract the configuration.
This is a second stage file, you find the [first stage here](https://samplepedia.cc/sample/5bc8b1a067ec4b487e88c2bb93728158633f4fdf22b111d5562cbb4ad3426d30/31/)
|
1
|
|
0
|
04 Jan 2026
|
5bc8b1a067ec4b487e88c2bb93728158633f4fdf22b111d5562cbb4ad3426d30
|
struppigel
|
medium
|
|
Deobfuscate this loader such that you get the download URL.
|
2
|
|
0
|
04 Jan 2026
|
0ad4f87dfa9b814b78e9db2360a89ea7940fb5ad919637bbaacb1222fb44098d
|
struppigel
|
medium
|
|
Write an emulation-based unpacker for this crypter. Use the native 32-bit stub and RunPE shellcode. Ignore .NET.
|
1
|
|
0
|
31 Dec 2025
|
9c692a0bf6d9d784e705dbd5f8fe8089d31eeab6fe196f9288573fd4aa3c5fa6
|
0xca5ade19a931
|
medium
|
|
Extract the payload and describe how it is executed. List the different evasion techniques that are implemented. What encryption and hashing algorithms do you encounter?
|
1
|
|
0
|
21 Sep 2026
|
5a26fd462a809c89b0448318591cb98a77a7b96fca658815dc0f547a51958bed
|
fs-0xC0
|
medium
|
|
document infection chain loading LxBase RAT, extracting it's configuration and unveiling functionality using decrypted strings
|
1
|
|
0
|
03 Aug 2026
|
db5d284b9a9c02f76030ba89fd85c7c8f830f8fe4195cdc1f9cddf15f127125d
|
struppigel
|
medium
|
|
Deobfuscate the strings and markup the code of this rootkit. What exactly can it hide?
|
1
|
|
0
|
13 Jun 2026
|
060ed0ec27a0a4ad7b55425ed56d8ef0c55aa61b499d4884d1679f18d518ddf3
|
struppigel
|
medium
|
|
Find the two webhooks of this stealer and determine the persistence mechanisms.
|
1
|
|
0
|
23 Mar 2026
|
49660527c1c910ad2d3c5625c1b44682e465e45b65883dfc8d7d229d1bd0ebd8
|
struppigel
|
advanced
|
|
Extract the main.js, decompile and deobfuscate it so far that you can see the webhook
|
1
|
|
0
|
07 Mar 2026
|
b0e365c603013751085946ff0500f7d8c0e3c106d3b02c368c2f267279660a6d
|
struppigel
|
medium
|
|
Write a configuration extractor for this loader
|
1
|
|
0
|
28 Feb 2026
|