FeedDiscussion
TryHackMe : Packed Light Writeup
TL;DR A .pcapng capture shows a victim host on 192.168.1.141 downloading a Python keylogger (updates.py) from an attacker-controlled "hotel update server" at byte-lotus-hotel.thm:8080 (34.41.103.191).
exploitnotes.hashnode.dev6 min read
#tryhackme#thm#packed-light#wireshark#t-shark#digital-forensics#wireshark-packet-analysis#network-forensics#malware-analysis#traffic-analysis#http-analysis#python-malware#keylogger#base64#xor-encryption#incident-response#blue-team
Responses
No responses yet.