Analyze a cryptocurrency phishing kit to identify exfiltration methods, extract critical IOCs, and gather threat actor intelligence using local logs and Telegram APIs.
A decentralized finance (DeFi) platform recently reported multiple user complaints about unauthorized fund withdrawals. A forensic review uncovered a phishing site impersonating the legitimate PancakeSwap exchange, luring victims into entering their wallet seed phrases. The phishing kit was hosted on a compromised server and exfiltrated credentials via a Telegram bot.Your task is to conduct threat intelligence analysis on the phishing infrastructure, identify indicators of compromise (IoCs), and track the attacker’s online presence, including aliases and Telegram identifiers, to understand their tactics, techniques, and procedures (TTPs).
Easy - Threat Intel | Completion Achievement
Inside the provided file, we are provided with a directory which appears to be a .github repo:
└─$ ls -a pankewk
. .DS_Store .eslintignore .github _next background1.jpg cgi-bin images log metamask
.. .editorconfig .eslintrc .prettierrc.js background.jpg background2.jpg favicon.ico index.html logo.png src- Which wallet is used for asking the seed phrase?
Opening the index.html file in the root directory, we will find the following webpage:
Clicking on the buttons will make the html document try to open another a login screen for each wallet. The Metamask button attempts to open the /metamask URI through a pop-up. Inside our repo, there is a metamask directory that contains an index.html file. Opening that file on our browser, we are asked for our seed phrase to login:
- What is the file name that has the code for the phishing kit?
Looking inside the metamask directory should yield us with some answers.
The rest of the php file contains a script to send the seed phrase to a remote location through a web request. This must be our phishing kit.
- In which language was the kit written?
The kit was written in PHP, based on the PHP tags and the file extension.
- What service does the kit use to retrieve the victim's machine information?
Based on the first lines of the phishing kit, we can see that the script uses a geolocation service to obtain geographical data of the victim's machine. Going back to the script, we can look up the API endpoint and retrieve our answer.
- How many seed phrases were already collected?
Inside the second part of the PHP script, we can see what the script does with the stolen credentials:
sendTel($message);
function sendTel($message){
...
$_POST["import-account__secret-phrase"]. $text = $_POST['data']."\n";;
@file_put_contents($_SERVER['DOCUMENT_ROOT'].'/log/'.'log.txt', $text, FILE_APPEND);
}
?>The files are stored in the /log/log.txt file. Let's find a similar file in the repository and find the collected credentials.
└─$ cat log/log.txt
number edge rebuild stomach review course sphere absurd memory among drastic total
bomb stairs satisfy host barrel absorb dentist prison capital faint hedgehog worth
father also recycle embody balance concert mechanic believe owner pair muffin hockeyThere are 3 lines here, each containing a stolen seed phrase.
- Could you please provide the seed phrase associated with the most recent phishing incident?
Knowing that the PHP script appends the newest seed phrase, the most recent seed phrase should be at the bottom of the log/log.txt file.
- Which medium was used for credential dumping?
This is the rest of the PHP script, demonstrating that the attacker used Telegram to send HTTP requests containing credentials back to the attacker.
- What is the token for accessing the channel?
The token can be found inside the $token variable within the sendTel() function.
- What is the Chat ID for the phisher's channel?
The Chat ID can be found in the $id variable inside the sendTel() function.
- What are the allies of the phish kit developer?
After the geolocation data retrieval, there is a comment signed by the allies of the phish kit developer:
/*
With love and respect to all the hustler out there,
This is a small gift to my brothers,
All the best with your luck,
Regards,
j1j1b1s@m3r0
*/Quick fact about this challenge: it seems that some questions were removed after #10 since it involved interacting with the actual Telegram endpoint. For more information about them, look up other writeups about this CyberDefenders challenge online or in the Featured Writeups section.