In this challenge, players will reverse engineer the executable to uncover the attacker’s tactics, techniques, and procedures (TTPs), gaining hands-on experience in binary analysis, persistence detection, and identifying malicious network behavior to support endpoint security operations.
The sample is a 32-bit Windows executable with mid-range entropy, so it is not heavily packed and its strings and code read cleanly. It replicates itself under one service-style name, gates execution on the system locale, and forces fresh data from its C2 by evicting the URL cache entry before each request. Its core function is a clipper: it joins the clipboard viewer chain, reacts to change notifications, and overwrites copied wallet addresses with an attacker-controlled one hard-coded in the binary. It also sends SSDP discovery probes to the standard multicast group. Resolving the victim’s ENS name and following the attacker wallet on a public block explorer tied the sample to a real on-chain transfer, and the overall behaviour set pointed to a known commodity botnet family.
pefile for imports and sections, Capstone for scripted disassembly and strings for ASCII and UTF-16 textTip: A stripped PE has no function labels. Scanning for
push ebp; mov ebp, espprologues and then locating callers of an imported API gives workable function starts. Treat the boundaries as heuristic.
Shannon entropy over the raw bytes of the whole file comes out well below the 7+ range of a packed or encrypted binary, which says the code and strings are readable and static analysis will work. Truncate rather than round: the raw value runs past the third decimal, so the third digit stays as it is.
python3 -I -c "import math,collections,sys;d=open(sys.argv[1],'rb').read();c=collections.Counter(d);print(-sum(v/len(d)*math.log2(v/len(d)) for v in c.values()))" optimize.exeFrom Q2 the sample checks its own filename first. The code that follows reads region information through a locale API, which is the geo-gate: the sample stops on systems in certain regions. List the imports for locale-related names, then disassemble around the call that follows the filename comparison with Capstone (the function at 0x40ea40). This one was reasoned from the purpose of the call in that function and the 14-character format mask, not read from a labelled artifact.
python3 -I -c "import pefile,sys;pe=pefile.PE(sys.argv[1]);[print(f.name.decode()) for i in pe.DIRECTORY_ENTRY_IMPORT for f in i.imports if f.name]" optimize.exe | grep -i localeHint: Look for
Get*Locale*style imports, then check which one is called right after the filename comparison.
Dump the UTF-16 strings and read .rdata around the odd identifier l9n7b5f2r. A wide-string executable name sits right beside it, built to look like a Windows service binary. Every copy of the sample is written under that name.
strings -el optimize.exe | grep -i -B2 -A2 'l9n7b5f2r'Disassemble the function at 0x407680 and walk its calls in order. The WinINet call that sits at 0x407767, just before the request goes out, evicts the URL from the local cache, so the fetch hits the server instead of a stale cached copy. Confirm the name against the WinINet entries in the import table.
python3 -I -c "import pefile,sys;pe=pefile.PE(sys.argv[1]);[print(i.dll.decode(),f.name.decode()) for i in pe.DIRECTORY_ENTRY_IMPORT for f in i.imports if f.name]" optimize.exe | grep -iE 'Url|Internet'Clipboard hijacking lives in a window procedure registered as a clipboard viewer. Scan the disassembly for call sites of SetClipboardViewer, GetClipboardData and DefWindowProcA: one function holds all three, which makes it the clipboard window proc. This was reasoned from that API combination, not read from a symbol.
python3 -I -c "import pefile,sys;pe=pefile.PE(sys.argv[1]);[print(i.dll.decode(),f.name.decode()) for i in pe.DIRECTORY_ENTRY_IMPORT for f in i.imports if f.name]" optimize.exe | grep -iE 'Clipboard|DefWindowProc'A program registered with SetClipboardViewer is notified of every clipboard change by one window message, and the window proc from Q5 acts on it. The two-part, underscore-separated format mask fits only that message. This came from the viewer-chain mechanism, not from an immediate value read in the code.
Hint: Think about what Windows sends a clipboard viewer when the clipboard contents change.
The replacement is a separate routine from the watcher in Q5. Find the caller that chains OpenClipboard, EmptyClipboard and SetClipboardData: it empties the victim’s clipboard and writes the attacker’s data in its place. As with Q5, the address comes from that API combination in the Capstone scan.
python3 -I -c "import pefile,sys;pe=pefile.PE(sys.argv[1]);[print(i.dll.decode(),f.name.decode()) for i in pe.DIRECTORY_ENTRY_IMPORT for f in i.imports if f.name]" optimize.exe | grep -iE 'Clipboard'Gotcha: The Q5 function reads the clipboard; the one that writes it is a different function.
Resolve the ENS name to its Ethereum address with the ENS data API, then list that address’s transactions on a Blockscout explorer. One of them is a transfer to the attacker wallet hard-coded in the binary, dated 2025-05-14, and that is the transaction tied to the sample. The address also has a later, unrelated transaction from 2026, which is not what the question wants.
curl -s https://api.ensdata.net/jamilaaidos.ethGotcha: The binary contains a 66-character
0xstring that fits the format mask exactly. It is not a transaction for this ENS user, so check it on the explorer before trusting it.
Search the strings for M-SEARCH. The probe template sits next to its HOST: header, which carries the SSDP multicast group address and port.
strings optimize.exe | grep -A4 'M-SEARCH'Same template as Q9: the port is the suffix on the HOST: header value.
strings optimize.exe | grep 'HOST:'No hash lookup was done for this one. The family was reasoned from the behaviour set: a clipboard hijacker for crypto addresses, self-replication under a fixed system-looking name with removable-drive spread, and a DriveSecManager.exe string in the binary. That combination fits a well-known commodity botnet that was accepted as the answer. Because it rests on behaviour and not on an antivirus label, confirm with a hash lookup before relying on it in a report.
Tip: The 8-character mask narrows the field fast. Match it against families known for clippers and USB spreading.
| Phase | Action |
|---|---|
| Defense Evasion | Unpacked, mid-entropy PE; readable strings and code |
| Persistence | Replicates itself under one fixed service-style filename |
| Defense Evasion | Verifies its own filename, then reads locale information to gate execution by region |
| Command and Control | Deletes the URL cache entry before each C2 request to force fresh data |
| Collection | Registers in the clipboard viewer chain and reacts to clipboard-change messages |
| Impact | Empties the clipboard and writes an attacker wallet address in its place |
| Impact | Victim funds move to the attacker wallet on-chain |
| Discovery | Sends SSDP M-SEARCH probes to the multicast group |
| Type | Value |
|---|---|
| File | optimize.exe (81,920 bytes, entropy 6.414) |
| Filename | syscrondvr.exe |
| Filename | DriveSecManager.exe |
| Network | 239.255.255[.]250:1900/udp (SSDP M-SEARCH) |
| Transaction | 0xab2d474dad344da1e3b7ece6e7022c3295c52b176978337be82288a59e5a2a40 |
| ENS name | jamilaaidos[.]eth |
| Technique | ID | Description |
|---|---|---|
| Obfuscated Files or Information | T1027 | Entropy check to judge whether the sample is packed |
| System Location Discovery: System Language Discovery | T1614.001 | Locale lookup used to gate execution by region |
| Application Layer Protocol: Web Protocols | T1071.001 | HTTP fetches from C2 with the cache entry deleted first |
| Clipboard Data | T1115 | Clipboard viewer chain reads copied content |
| Data Manipulation: Transmitted Data Manipulation | T1565.002 | Clipboard contents replaced with an attacker wallet |
| Network Service Discovery | T1046 | SSDP M-SEARCH probes to the multicast group |
| Replication Through Removable Media | T1091 | USB-spreading behaviour used to attribute the family (inferred) |
Clipboard viewer registration from an unsigned process is a detection primitive. SetClipboardViewer together with SetClipboardData in a binary with no UI is the clipper signature. Static YARA on that import combination catches the family, and runtime EDR can flag processes that rewrite the clipboard moments after a copy.
Users should verify wallet addresses after pasting. The attack only works if the victim sends funds to the pasted address unchecked. Wallet software that matches against an address book or asks for confirmation of the first and last characters defeats the swap.
Fixed filenames make good hunting seeds. The sample copies itself everywhere under one service-looking name. A file-creation rule for that name outside System32, or a service-sounding name running from a user profile or removable drive, is cheap and precise.
SSDP from a workstation process is unusual. A non-browser process sending M-SEARCH to the multicast group on UDP 1900 deserves a look. Network sensors can alert on it, and it often accompanies removable-media or lateral activity.
The sample is small and unpacked, yet it quietly redirects a victim’s crypto transfers by rewriting the clipboard. The on-chain trail, through the ENS name and the wallet hard-coded in the binary, shows the theft is real and traceable, while the code itself gives defenders plenty of static hooks.