uncxxxx

b0ru

An endpoint on a corporate network started behaving oddly shortly after an employee downloaded what appeared to be a legitimate VMware infrastructure management tool.

The IR team captured these artifacts before the host was rebuilt.

Flag format: mntcrl{...} the flag is split into three parts across the provided artifacts and open-source intelligence.

This challenge ships an image that contains real malware samples, partially sanitized and repurposed for this CTF challenge. The authors take no responsibility for damage caused by improper handling.

Connection https://drive.google.com/drive/folders/1JzEajamHORpz6oDSoQ421QXd1edHhq0P?usp=sharing