DFIR_3_RAMsomwhere

forensics dfir slsanna

We have been notified of an attack in one of our machines. This is a real forensics investigation and you have to analyse the given elf file and answer to the related questions. At the end you will get the flag when you answer everything correct.

For questions related to finding something network related "not present in the pcap" - we are referring to the pcap of DFIR2 - MalNet.

NOTE: This is a real malware. Do not execute nothing. Pay attention and be careful. Srdnlen denies every damage on your infrastructure.