One Of Us - HackTheBox Challenge Writeup

Challenge Information

Challenge Description

Dark Pointy Hats are causing trouble again. This time, they have targeted Invisible Shields and the protectors of the forbidden spells. They developed a specific spyware that aims to get access to the forbidden spells server.

The challenge provides:

• A sample of the spyware
• Suspicious mail that appears to be produced by the spyware

Your objective is to analyze these files and determine what happened during the attack.

Approach & Analysis Strategy

This forensics challenge requires a systematic approach to malware and artifact analysis:

1. File Examination - Begin by identifying file types and metadata
2. Spyware Analysis - Examine the malware sample for indicators of compromise (IOCs)
3. Email Forensics - Parse the suspicious mail for headers, content, and embedded artifacts
4. Correlation - Link findings from both the spyware and mail samples
5. Timeline Reconstruction - Establish the sequence of malicious activities

Key Steps

Step 1: Initial File Reconnaissance

# List all provided challenge files
ls -la

# Identify file types
file *

# Check for file signatures and magic bytes
hexdump -C <file> | head -20

Step 2: Spyware Sample Analysis

# Extract strings from the malware binary
strings <spyware_sample> | grep -i "http\|ftp\|cmd\|exec\|shell"

# Look for suspicious patterns
strings <spyware_sample> | grep -E "smtp|mail|exfil|command"

# Check for embedded configuration
strings <spyware_sample> | sort | uniq

Step 3: Email Analysis

# Examine email headers for source tracking
head -50 <suspicious_mail>

# Extract sender, recipient, and timestamp information
grep -E "^From:|^To:|^Date:|^Subject:" <suspicious_mail>

# Look for embedded payloads or attachments
file <suspicious_mail>

# Parse email structure (if MIME encoded)
strings <suspicious_mail> | grep -i "boundary\|attachment\|content-type"

Step 4: Correlation and IOC Extraction

# Cross-reference domains/IPs found in both files
grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' <spyware_sample> <suspicious_mail>

# Extract command and control (C2) infrastructure
strings <spyware_sample> | grep -i "callback\|beacon\|c2"

Tools Used

• strings - Extract readable text from binary files
• file - Identify file types and formats
• hexdump - Examine binary data at the byte level
• grep - Pattern matching and IOC hunting
• Standard Linux utilities - For file analysis and correlation

Key Learnings

1. Multi-file Correlation - Spyware challenges often require connecting artifacts from multiple sources (binaries and communications)
2. Metadata Analysis - Email headers and file timestamps provide critical context for timeline reconstruction
3. String Extraction - Malware often contains readable strings that reveal C2 addresses, commands, and capabilities
4. Forensic Rigor - Document all findings with file paths and hash values when possible
5. Indicator of Compromise (IOC) Hunting - Focus on identifying domains, IPs, process names, and registry keys that indicate malicious activity

Flag Format

When you identify the vulnerability or secret data exfiltrated by the spyware, submit it in the format:

HTB{<redacted>}

Note: This challenge emphasizes the importance of thorough forensic analysis when dealing with targeted malware campaigns. The connection between the spyware sample and the suspicious mail likely reveals the attack vector and objectives of the threat actors.