HookFlare

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Medium | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

A S1rBank client reported unauthorized transactions. The victim received an SMS urging a banking app update via a link, which installed a dormant app mimicking the bank’s official version. Once activated, it stole credentials, bypassed 2FA via SMS interception, and exfiltrated data. As a DFIR specialist, analyze the Android disk image to uncover the malware’s operation, reconstruct the attack chain, and identify critical IoCs.

Key Questions

1. What indicators of compromise exist?
2. What attack chain / MITRE techniques were used?
3. What is the full timeline?

Investigation Timeline

Evidence Analysed

• Tools: per the investigation narrative.
• Artifacts: per the investigation narrative.

Detailed Investigation

1. In this challenge

1ST QUESTION --> ANS:

REDACTED

3RD QUESTION --> ANS:

REDACTED

5TH QUESTION --> ANS:

REDACTED

7TH QUESTION --> ANS:

REDACTED

9TH QUESTION --> ANS:

REDACTED

Findings

1. Persistence mechanism — As documented in the investigation steps.
2. Initial access — As documented in the investigation steps.
3. Impact — As documented in the investigation steps.

MITRE ATT&CK Mapping

Answers / Flags

• 1ST QUESTION --> ANS:REDACTED
• 2ND QUESTION --> ANS:REDACTED
• 3RD QUESTION --> ANS:REDACTED
• 4TH QUESTION --> ANS:REDACTED
• 5TH QUESTION --> ANS:REDACTED
• 6TH QUESTION --> ANS:REDACTED
• 7TH QUESTION --> ANS:REDACTED
• 8TH QUESTION --> ANS:REDACTED
• 9TH QUESTION --> ANS:REDACTED
• 10TH QUESTION --> ANS:REDACTED

Lessons Learned

1. Correlate artifacts across evidence sources to build a timeline.
2. Map findings to MITRE ATT&CK techniques.
3. Document IoCs for detection engineering.