GrabThePhisher Write-up

:الحمد لله والصلاة والسلام على رسول الله وعلى آله وصحبه أما بعد

Instructions:

• Uncompress the lab (pass: cyberdefenders.org )

Scenario:

An attacker compromised a server and impersonated https://pancakeswap.finance/, a decentralized exchange native to BNB Chain, to host a phishing kit at https://apankewk.soup.xyz/mainpage.php. The attacker set it as an open directory with the file name “pankewk.zip”.

Provided the phishing kit, you as a soc analyst are requested to analyze it and do your threat intel homework.

Link: https://cyberdefenders.org/blueteam-ctf-challenges/grabthephisher/

Medium: https://medium.com/@GLITCHGC/grabthephisher-write-up-b99849f18a73

---

Questions:

1. Which wallet is used for asking the seed phrase?

After Download the zip file you will notice an index.html file open it

The answer will be the first wallet, and the answer depends on the folder named after it in the zip file

Answer: Metamask

---

2. What is the file name that has the code for the phishing kit?

Answer: What is the file name that has the code for the phishing kit?

---

3. In which language was the kit written?

Answer: PHP

---

4. What service does the kit use to retrieve the victim’s machine information?

Answer: Sypex Geo

---

5. How many seed phrases were already collected?

Answer: 3

---

6. Write down the seed phrase of the most recent phishing incident?

Answer: father also recycle embody balance concert mechanic believe owner pair muffin hockey

---

7. Which medium had been used for credential dumping?

Answer: Telegram

---

8. What is the token for the channel?

Answer: 5457463144:AAG8t4k7e2ew3tTi0IBShcWbSia0Irvxm10

---

9. What is the chat ID of the phisher’s channel?

Answer: 5442785564

---

10. What are the allies of the phish kit developer?

Answer: j1j1b1s@m3r0

---

11. What is the full name of the Phish Actor?

Request the api to get the answers “https://api.telegram.org/bot5457463144:AAG8t4k7e2ew3tTi0IBShcWbSia0Irvxm10/getChat?chat_id=5442785564”

Answer: Marcus Aurelius

---

12. What is the username of the Phish Actor?

Answer: pumpkinboii

---

You Can Find me Here!

Blog: https://g1it0h.gitbook.io/glitch/

Linkedin: https://www.linkedin.com/in/glitchgc/

Facebook: https://www.facebook.com/GLITC.GC/

Tryhackme: https://tryhackme.com/p/GLITCH1GC