Posts on Ahmad Massd — Security Blog

Aliens CTF — DFIR: 7 Oct

ahmad.massad.ir@gmail.com (Ahmad Massad) — Wed, 20 Aug 2025 00:00:00 +0000

Challenge: 7 Oct
#

Description
#

We stormed one of the enemy’s concentration areas and after completing the operation, we took some devices to investigate and obtain intelligence. One device belongs to a leader. We believe information is being leaked through a spy. Search the device to find the spy and location details — the enemy was planning a prisoner recovery operation and location information had been leaked to them.

Cyber Warriors CTF — Forensics: Investigation Nashmi APT

ahmad.massad.ir@gmail.com (Ahmad Massad) — Sat, 16 Aug 2025 00:00:00 +0000

Introduction
#

Our Security Operations Center (SOC) detected suspicious activity originating from an internal employee workstation. The employee — a finance team member — reported slow system performance and unexpected behavior. Shortly after, EDR logs showed signs of malware persistence and suspicious outbound traffic.

Mission: Analyze a full memory image of the compromised machine, identify the scope of the infection, and answer key investigation questions.

The Anatomy of Phantom Stealer

ahmad.massad.ir@gmail.com (Ahmad Massad) — Thu, 10 Jul 2025 00:00:00 +0000

Overview
#

Analysis of a malicious VBScript file (LPO_337860.vbs.bin) acting as a loader for Phantom Infostealer. The script employs heavy obfuscation, environmental checks, and persistence mechanisms.

Sample Information

Field	Value
Filename	`LPO_337860.vbs.bin`
MD5	`074a04eafe704a893655025b80beffb6`
File Type	VBScript
Threat	Phantom Infostealer Loader

Stage 0 — VBScript Loader (`LPO_337860.vbs.bin`)
#

The initial VBScript acts as a deobfuscation and file-dropping engine in two steps:

Claude Never Asked You to Run That

ahmad.massad.ir@gmail.com (Ahmad Massad) — Tue, 01 Jul 2025 00:00:00 +0000

Incident Overview
#

While conducting a threat hunting deep dive into a resolved ClickFix incident, I tracked the infection chain back to the landing domain turbowave45[.]com. The original execution chain on the target Windows workstation was highly indicative of a modern social engineering / fake update lure:

chrome.exe → explorer.exe → powershell.exe → mshta.exe https://purematrixa[.]com/1751517

The EDR flagged and killed the process at:

Posts on Ahmad Massd — Security Blog

Aliens CTF — DFIR: 7 Oct

Challenge: 7 Oct #

Description #

Cyber Warriors CTF — Forensics: Investigation Nashmi APT

Introduction #