# Attaaaaack13

## Background

Q13. Now can you help us to know the Family of this malware ?

example : crew{Malware}

Author : 0xSh3rl0ck


## Find the flag

**To find the malware's family, we can first grab the SHA256 hash of the `runddl.exe` malware from [VirusTotal](https://www.virustotal.com/gui/file/9601b0c3b0991cb7ce1332a8501d79084822b3bdea1bfaac0f94b9a98be6769a/details):**

- SHA256 hash: `9601b0c3b0991cb7ce1332a8501d79084822b3bdea1bfaac0f94b9a98be6769a`

**Go to Cisco Talos Intelligence Group's [Talos File Reputation](https://www.talosintelligence.com/talos_file_reputation), and search for it's malware family via the SHA256 hash:**



**According to [Microsoft malware naming scheme](https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/malware-naming?view=o365-worldwide), the naming scheme is:**


In the Talos File Reputation's result, it has `Backdoor.Win32.DarkKomet`.

Hence, the `runddl.exe` malware family is `DarkKomet`.

- **Flag: `crew{DarkKomet}`**

Original writeup (https://siunam321.github.io/ctf/CrewCTF-2023/Forensics/Attaaaaack1-13/#attaaaaack13).