DroidPhish

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

Last night, most employees' mobile devices were compromised, putting them at significant risk of leaking personal and private information. We require your expertise in digital forensics to help investigate this breach.

Key Questions

1. What indicators of compromise exist?
2. What attack chain / MITRE techniques were used?
3. What is the full timeline?

Investigation Timeline

Evidence Analysed

• Tools: per the investigation narrative.
• Artifacts: per the investigation narrative.

Detailed Investigation

1. In

1ST QUESTION -> ANS: REDACTED

2ND QUESTION -> ANS: REDACTED

3RD QUESTION -> ANS: REDACTED

4TH QUESTION -> ANS: REDACTED

5TH QUESTION -> ANS: REDACTED

6TH QUESTION -> ANS: REDACTED

7TH QUESTION -> ANS: REDACTED

8TH QUESTION -> ANS: REDACTED

9TH QUESTION -> ANS: REDACTED

10TH QUESTION -> ANS: REDACTED

Findings

1. Persistence mechanism — As documented in the investigation steps.
2. Initial access — As documented in the investigation steps.
3. Impact — As documented in the investigation steps.

MITRE ATT&CK Mapping

Answers / Flags

• 1ST QUESTION -> ANS: REDACTED
• 2ND QUESTION -> ANS: REDACTED
• 3RD QUESTION -> ANS: REDACTED
• 4TH QUESTION -> ANS: REDACTED
• 5TH QUESTION -> ANS: REDACTED
• 6TH QUESTION -> ANS: REDACTED
• 7TH QUESTION -> ANS: REDACTED
• 8TH QUESTION -> ANS: REDACTED
• 9TH QUESTION -> ANS: REDACTED
• 10TH QUESTION -> ANS: REDACTED

Lessons Learned

1. Reviewing android image file using FTK imager and mount it on linux (identify last device boot time).
2. Performing android e-mail and browser forensics (identify phish mail, malicious apk file, and installation timestamp).
3. Performing static analysis on Android APKs (identify runtime permissions).
4. Using wireshark and virus total to identify C2 IP Address and it's port.