$tealer Blue Team Challenge

How many imported windows APIs are being used by the sample?

The sample is resolving the needed win APIs at run-time using API hashing. Looking at the DllEntryPoint, which function is responsible for resolving the wanted APIs?

Looking inside the function described in question 3, which function is responsible for locating & retrieving the targetted module (DLL)?

What type of hashing is being used for the API hashing technique?

What is the address of the function which performs the hashing?

What key is being used for XORing the hashed names?

What information is being accessed at the address 0X60769A?

Looking inside the function described in question 3, which function is responsible for locating & retrieving the targetted API from the module export table?

Diving inside the function described in question 8, what is being accessed at offset 0X3C within the first passed parameter?

Which windows API is being resolved at the address 0X5F9E47 ?

Looking inside sub_607980, which DLL is being resolved?

Also Looking inside sub_607980, which API is being resolved?

What is the appropriate data type of the only argument at function sub_607D40?

After reverse-engineering sub_607980 and knowing its purpose, Which assembly instruction is being abused for further anti-analysis complication? (especially when running the sample)

After reverse-engineering sub_607980 and knowing its purpose, Which assembly instruction is being used for altering the process execution flow? (Also adds anti-disassembly complication)

There are important encrypted strings in the .data section. Which encryption algorithm is being used for decryption?

What is the address of the function that is responsible for strings decryption?

What are the two first decrypted words (strings) at 0X629BE8?

What is the key used for decrypting the strings in question 16?

What is the length (in bytes) of the used key in question 16?

What is the address of the function that is responsible for connecting to the C&C?

What is the first C&C IP address in the embedded configuration?

What is the port associated with the first C&C IP address?

How many C&C IP addresses are in the sample configuration?

What is the address of the function which downloads additional modules to extend the malware functionality?