Ahmad Massd — Security Blog

Aliens CTF — DFIR: 7 Oct

ahmad.massad.ir@gmail.com (Ahmad Massad) — Wed, 20 Aug 2025 00:00:00 +0000

Challenge: 7 Oct
#

Description
#

We stormed one of the enemy’s concentration areas and after completing the operation, we took some devices to investigate and obtain intelligence. One device belongs to a leader. We believe information is being leaked through a spy. Search the device to find the spy and location details — the enemy was planning a prisoner recovery operation and location information had been leaked to them.

Cyber Warriors CTF — Forensics: Investigation Nashmi APT

ahmad.massad.ir@gmail.com (Ahmad Massad) — Sat, 16 Aug 2025 00:00:00 +0000

Introduction
#

Our Security Operations Center (SOC) detected suspicious activity originating from an internal employee workstation. The employee — a finance team member — reported slow system performance and unexpected behavior. Shortly after, EDR logs showed signs of malware persistence and suspicious outbound traffic.

Mission: Analyze a full memory image of the compromised machine, identify the scope of the infection, and answer key investigation questions.

The Anatomy of Phantom Stealer

ahmad.massad.ir@gmail.com (Ahmad Massad) — Thu, 10 Jul 2025 00:00:00 +0000

Overview
#

Analysis of a malicious VBScript file (LPO_337860.vbs.bin) acting as a loader for Phantom Infostealer. The script employs heavy obfuscation, environmental checks, and persistence mechanisms.

Sample Information

Field	Value
Filename	`LPO_337860.vbs.bin`
MD5	`074a04eafe704a893655025b80beffb6`
File Type	VBScript
Threat	Phantom Infostealer Loader

Stage 0 — VBScript Loader (`LPO_337860.vbs.bin`)
#

The initial VBScript acts as a deobfuscation and file-dropping engine in two steps:

Claude Never Asked You to Run That

ahmad.massad.ir@gmail.com (Ahmad Massad) — Tue, 01 Jul 2025 00:00:00 +0000

Incident Overview
#

While conducting a threat hunting deep dive into a resolved ClickFix incident, I tracked the infection chain back to the landing domain turbowave45[.]com. The original execution chain on the target Windows workstation was highly indicative of a modern social engineering / fake update lure:

chrome.exe → explorer.exe → powershell.exe → mshta.exe https://purematrixa[.]com/1751517

The EDR flagged and killed the process at:

About

ahmad.massad.ir@gmail.com (Ahmad Massad) — Wed, 01 Jan 2025 00:00:00 +0000

Hi, I’m Ahmad Massad
#

I’m a DFIR Investigator specializing in Windows internals, memory forensics, and kernel-level telemetry. Rooted in proactive threat hunting, my focus is on dissecting complex attacks, analyzing malware, and building custom defensive tools to get as close to the metal as possible. When I’m not deep in an investigation, I’m usually competing in CTFs, sharpening my reverse engineering skills, or hitting the weights at the gym. This space is my digital command center for sharing technical research, write-ups, and practical lessons learned from the trenches.

Ahmad Massd — Security Blog

Aliens CTF — DFIR: 7 Oct

Challenge: 7 Oct #

Description #

Cyber Warriors CTF — Forensics: Investigation Nashmi APT

Introduction #