View source for HTB (sherlock): Dream Job-2

Pertama download filenya, pas di-extract dia muncul lagi dua file: <code>DANGER.txt</code> dan <code>DANGER.zip</code>

[[File:Sherlock-dream-job2-1.png]]

abis itu extract lagi <code>DANGER.zip</code>, password nya ada di <code>DANGER.txt</code>. Nanti isinya bakal ada 3 file

[[File:Sherlock-dream-job2-2.png|950px]]

== According to MITRE ATT&CK, what previously known malware does DRATzarus share similarities with? ==
Buka google, terus searching '''MITRE ATT&CK DRATzarus''', harusnya paling atas ada https://attack.mitre.org/software/S0694/ 

[[File:Sherlock-dream-job2-3.png]]

Jadi jawabannya adalah '''Bankshot'''

== Which Windows API function does DRATzarus use to detect the presence of a debugger? == 
Masih di link yang sama, scroll ke bawah dikit 

[[File:Sherlock-dream-job2-4.png]]

Jawabannya '''IsDebuggerPresent'''