The Crime - CyberDefenders Lab Writeup

We're currently in the midst of a murder investigation, and we've obtained the victim's phone as a key piece of evidence. After conducting interviews with witnesses and those in the victim's inner circle, your objective is to meticulously analyze the information we've gathered and diligently trace the evidence to piece together the sequence of events leading up to the incident.

Easy - Endpoint Forensics | Completion Achievement

For this lab, we are going to download the aleapp-v3.6.0-Linux_x86_64.AppImage binary from the GitHub repository. Here's a few commands I did to get started:

$ mv aleapp-v3.6.0-Linux_x86_64.AppImage aleapp
$ chmod +x aleapp

Once we download the lab files (don't extract for now!), we can start our investigation.

1. Based on the accounts of the witnesses and individuals close to the victim, it has become clear that the victim was interested in trading. This has led him to invest all of his money and acquire debt. Can you identify the SHA256 of the trading application the victim primarily used on his phone?

Let's create a set of artifacts with aleapp to analyze the evidence:

└─$ ./aleapp -i temp_extract_dir -o results -t fs

This will create all necessary artifacts and setup a dashboard for visual analysis of the data. You can access this dashboard by opening the index.html file:

┌──(hiram㉿kali)-[~/cyberdefenders/TheCrime/results/ALEAPP_Reports_2026-06-11_Thursday_162924]
└─$ ls
'Script Logs'   _HTML  '_TSV Exports'   _Timeline   _lava_artifacts.db   _lava_data.json   data   index.html

┌──(hiram㉿kali)-[~/cyberdefenders/TheCrime/results/ALEAPP_Reports_2026-06-11_Thursday_162924]
└─$ open index.html

Let's look at the sidebar and investigate Installed Apps > Installed Apps (GMS) for user 0 to find which applications were downloaded by the user:

The com.ticno.olymptrade application appears to be the trading application we were looking for.

2. According to the testimony of the victim's best friend, he said, "While we were together, my friend got several calls he avoided. He said he owed the caller a lot of money but couldn't repay now". How much does the victim owe this person?

Let's try checking other artifacts that are related to the user having a conversation with other people. After looking at many artifacts, I reached the SMS messages section and found a threatening message showing how much the user owed this person in Egypt:

3. What is the name of the person to whom the victim owes money?

Based on the SMS message we just read, we can find the phone number associated with the sender: +201172137258. Let's read the Contacts list to see if we have a match:

That's our contact!

4. Based on the statement from the victim's family, they said that on September 20, 2023, he departed from his residence without informing anyone of his destination. Where was the victim located at that moment?

At first, I tried looking for GPS/Geolocation information Artifacts, but I found nothing. I tried to look at the Artifacts generated by Chrome, but I found no relevant information. Looking at Recent Activity 0 reveals that the victim used Google Maps recently, and the snapshot shows where the user was located on September 20, 2023 at around 23:50PM:

Our answer can be found inside the Snapshot_Image:

5. The detective continued his investigation by questioning the hotel lobby. She informed him that the victim had reserved the room for 10 days and had a flight scheduled thereafter. The investigator believes that the victim may have stored his ticket information on his phone. Look for where the victim intended to travel.

People usually store their flight tickets in their Photo Gallery. Looking at the Google Photos (gphotos-1) - Cache report will show many photos displaying plane tickets, which contain the looking about where the victim intended to travel:

6. After examining the victim's Discord conversations, we discovered he had arranged to meet a friend at a specific location. Can you determine where this meeting was supposed to occur?

As the question implies, we can find our answer from Discord artifacts by navigating to the Discord Chats report.