Back to case studies
Intermediate1 h - 1 h 30
Infostealer campaign through malvertising
Three workstations downloaded a trapped “7-Zip installer”. Analyze the sandbox report, cluster the samples, pivot on the infrastructure and choose the right response measures.
Briefing
At Lumea Pharma, three developers installed a compression tool in the same week. The next day, one of them sees unknown sign-ins on his corporate GitHub account, even though it is protected by MFA. You have the browsing history of one workstation, the installer sandbox report, the metadata of the three samples and an infrastructure lookup.
Fictional scenario and data, built on real techniques. .example domains and documentation IP ranges.
Objectives
- Identify the infection vector
- Classify the malware family from its behavior
- Cluster samples with different hashes
- Pivot on the C2 infrastructure
- Prioritize the response: why MFA was not enough
Tools used in real investigations
ANY.RUN / CAPE SandboxVirusTotalYARASigmaurlscan.iocrt.sh / Censys
100% Free
Ready to put it into practice?
CyberXTEL is our free platform to train hands-on: certifications, CTFs and a dedicated cyber awareness space.