Blue Team CTF-XLMRat Lab

Analyze network traffic to identify malware delivery, deobfuscate scripts, and map attacker techniques using MITRE ATT&CK, focusing on stealthy execution and reflective code loading.

Scenario

A compromised machine has been flagged due to suspicious network traffic. Your task is to analyze the PCAP file to determine the attack method, identify any malicious payloads, and trace the timeline of events. Focus on how the attacker gained access, what tools or techniques were used, and how the malware operated post-compromise.

Questions

Q1.The attacker successfully executed a command to download the first stage of the malware. What is the URL from which the first malware stage was installed?

追踪HTTP流，http://45.126.209.4:222/mdm.jpg

Q2.Which hosting provider owns the associated IP address?

直接查询IP信息，得到 ReliableSite.Net

Q3.By analyzing the malicious scripts, two payloads were identified: a loader and a secondary executable. What is the SHA256 of the malware executable?

流中可以看到这样一个文件。