
Ritsec CTF 2025 (Reverse)
Zogulon Traces Description Quick!! Chase K has been abducted! He will surely be turned into a Zogulon if we don’t find him in time. All I could find was this encoder for their hyperspace drive and...
Zogulon Traces Description Quick!! Chase K has been abducted! He will surely be turned into a Zogulon if we don’t find him in time. All I could find was this encoder for their hyperspace drive and...
Executive Summary An APK malware that can read the notifications and incoming calls on an Android device. It listens for specific events such as new messages from apps like WhatsApp or SMS. Upon de...
flag checker Description All you need to do is to guess the flag! Observation Running in IDA , upon entering the text, it will check on sub_127A t...
Executive Summary The executable file dropper.exe shows behaviors typically associated with dropper malware. It retrieves the system directory path, constructs a path to a target file (wupdmg.exe)...
Executive Summary The malware “WindowsUpdate.exe” is designed to establish persistence on the system, communicate with a command and control (C2) server, and execute system commands. It ensures it...
Executive Summary This document provides a detailed analysis of the SnakeKeylogger malware. Upon opening the malicious document, the macro executes automatically, downloads a file from a specified...
Executive Summary The method of found involves using msfvenom to generate a payload that creates a bind shell for remote access, which is then embedded into a program that hides its console window...
Executive Summary A sophisticated powershell script attack leveraging scheduled tasks, WMI (Windows Management Instrumentation), and RSA encryption to maintain persistence on compromised systems. ...
Executive Summary This exercise demonstrates bypassing the cmp instruction to obtain the flag. The most efficient method I found was through patching. Sample Information Attribu...
Executive Summary The dropper file exhibits malicious behavior by executing commands via cmd.exe, using a ping delay to time operations, and deploying a payload in a hidden manner. It connects to ...