Sandy

🐞 SANDY

Category	Author
🐞 Malware	John Hammond

Challenge Prompt

My friend Sandy is really into cryptocurrencies! She’s been trying to get me into it too, so she showed me a lot of Chrome extensions I could add to manage my wallets. Once I got everything sent up, she gave me this cool program!

She says it adds better protection so my wallets can’t get messed with by hackers.

Sandy wouldn’t lie to me, would she…? Sandy is the best!

[!CAUTION] This is the Malware category, and as such, includes malware. Please be sure to analyze these files within an isolated virtual machine.

Problem Type

• Cryptocurrency Malware

Password

[!NOTE] The password to the archive is infected.

Solve

Download and install AutoIT 3.2.4.9

• Copy of the ZIP in the folder too.

Run ExeToAut to decomplie

Find Base64 and decode in Cyber Chef

Decode again

Decode again

Scroll down for flag

Flag

flag{d60ea9faec46c2de1c72533ae3ad11d7}

(back to top)