# Just a VPN Login: VirusTotal - IP & Hash Logs (TryHackMe) Link to the challenge on TryHackMe: [Just a VPN Login](https://tryhackme.com/room/justavpnlogin) ## **Unusual Login** Welcome to your first shift! You are greeted by an internal alert on the SOC dashboard titled "Unusual VPN login of susan.martin@probablyfine.thm from 37.19.201.132 (Singapore)." The SOC handover notes did indeed mention that Susan from Marketing is in Singapore, attending a security vendor conference. It is probably just fine, but the SOC procedure tells us to verify each IP in our threat intel platform TryDetectThis. Answer the first **four** questions to gather more information and determine the threat level. ## **Security Check Tool** That login IP looks suspicious, doesn't it? Your teammates reached out to Susan, and she confirmed she did not log in to the company VPN. She also mentioned that while using a public Wi-Fi hotspot at a cafe, she was suddenly prompted to install a "security check" tool, which she did. The host telemetry reveals a suspicious binary with the hash **b8e02f2bc0ffb42e8cf28e37a26d8d825f639079bf6d948f8debab6440ee5630**. Can you help us figure out what this binary exactly does and answer the remaining questions? ## **TryDetectThis** TryDetectThis is a threat intelligence database to check the reputation and other details of IP addresses, domains, and file hashes. To access this platform, please navigate to the following URL in your own browser:  ![THM Key Credentials](https://cdn-images.tryhackme.com/user-uploads/678ecc92c80aa206339f0f23/room-content/678ecc92c80aa206339f0f23-1767880510535.png align="center") ## Answer the questions below ### What is the ASN number related to the IP? * Open TryDetectThis and search the provided IP\_Address ![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/f7a6b2c6-15d9-43ce-8034-af1123c55512.png align="center") ### Which service is offered from this IP? `vpn` ### What is the filename of the file related to the hash? ![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/92aa661b-e76b-4fbd-918a-581b51b434fd.png align="center") ### What is the threat signature that Microsoft assigned to the file? `Trojan:Win32/LummaStealer.PM!MTB` ![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/7beefd6a-3ddd-46bb-a707-d64776cdf4ef.png align="center") ### One of the contacted domains is part of a large malicious infrastructure cluster. Based on its HTTPS certificate, how many domains are linked to the same campaign? ![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/21b845ed-8374-4475-830f-d75590d23d05.png align="center") ![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/1b905718-43e4-455d-b868-0d5f1c17e346.png align="center") ```markdown nano domains.txt wc -l domains.txt 151 domains.txt ``` ### The file matches one of the YARA rules made by "kevoreilly". What line is present in the rule's "condition" field? ![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/117ad8e3-f4ea-468c-90d8-48580f893921.png align="center") ![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/07435ad8-e4f9-444e-bbef-ec236ce39ee4.png align="center") ### The file is also mentioned in a threat intel report. What is the title of the report mentioning this hash? ![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/f3b3f428-fd7c-4925-9fef-dcd045423b97.png align="center") ### Which team did the author of the malware start collaborating with in early 2024? ![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/c16c9922-5001-47ab-a0ef-7ea6ad163be9.png align="center") ### A Mexican-based affiliate related to the malware family also uses other infostealers. Which mentioned infostealer targets Android systems? ![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/29e8b5e1-dbd3-487f-b1e5-377b790e3f6b.png align="center") The report states that the affiliates behind the malware use the services of AnonRDP. Which Mitre ATT&CK sub-technique does this align with? ![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/8f347bf4-9932-4dd4-a806-0edc4d35b5fb.png align="center")