# Day 1 - OPSEC

### Investigating a Potentially Malicious YouTube to MP3 Converter Website

In the bustling digital world, where innovation often walks hand in hand with deception, McSkidy, a seasoned SOC analyst, found herself intrigued by whispers about a trending YouTube to MP3 converter website. Renowned for its sleek design and seamless functionality, it had gained rapid popularity among unsuspecting users. But McSkidy’s instincts told her that something was amiss.

The website’s meteoric rise seemed too convenient, and subtle inconsistencies in its operations suggested a darker narrative lurking beneath the surface. Armed with her investigative skills and a drive to uncover the truth, McSkidy decided to dig deeper. What began as a casual inquiry into an online tool soon unraveled into a complex web of malicious activity, poor OPSEC practices, and an overconfident adversary hiding in plain sight.

### 1\. The Initial Investigation

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1733609517292/77caa358-98f5-450b-a381-f461c61bf855.png align="center")

The website, accessed via a browser, presents a professional-looking interface. The **About Page** attributes its creation to "The Glitch," seemingly simplifying attribution. It even claims to be "Secure" and "Safe" in its feature list, which immediately raises suspicions.

* ### YouTube to MP3 Converters: Risks Galore
    

These tools have a notorious history of hosting significant risks:

* **Malvertising:** Malicious ads exploit system vulnerabilities.
    
* **Phishing Scams:** Users are lured into sharing sensitive information.
    
* **Bundled Malware:** Files come with hidden, malicious payloads.
    

### 2\. Downloading the Files

Testing the site involves using a YouTube link (e.g., [`https://www.youtube.com/watch?v=dQw4w9WgXcQ`](https://www.youtube.com/watch?v=dQw4w9WgXcQ)).

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1733609675817/59243800-1bbd-446e-a8fd-ea570f7d44f1.png align="center")

After downloading, we extract a [`download.zip`](http://download.zip) file containing:

* [`song.mp`](http://song.mp)`3`
    
* [`somg.mp`](http://somg.mp)`3`
    

### Analyzing the Files

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1733609787150/96bfa728-523d-4896-9c19-ed7f7e98070d.png align="center")

#### **File 1:** [**song.mp**](http://song.mp)**3**

Using the `file` command:

The output reveals it as a legitimate MP3 file:

> Audio file with ID3 version 2.3.0, MPEG ADTS, layer III

#### **File 2:** [**somg.mp**](http://somg.mp)**3**

On running `file` [`somg.mp`](http://somg.mp)`3`, we discover:

> MS Windows shortcut, with command line arguments

The file masquerades as an MP3 but is a **Windows shortcut file (.lnk)**, capable of executing commands.

### 3\. Digging Deeper with ExifTool

Using `exiftool` [`somg.mp`](http://somg.mp)`3`, we uncover:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1733609900397/b8e60ae1-6bde-43d5-b85a-970ba0311114.png align="center")

The command disables PowerShell restrictions, downloads a malicious script from [https://raw.githubusercontent.com/MM-WarevilleTHM/IS/refs/heads/main/IS.ps1](https://raw.githubusercontent.com/MM-WarevilleTHM/IS/refs/heads/main/IS.ps1), and executes it.

### Examining the PowerShell Script

The script from [https://raw.githubusercontent.com/MM-WarevilleTHM/IS/refs/heads/main/IS.ps1](https://raw.githubusercontent.com/MM-WarevilleTHM/IS/refs/heads/main/IS.ps1) :

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1733609944719/00897afb-180f-4c19-9357-c1a4c1b47f8c.png align="center")

The script collects sensitive information, including:

* **Cryptocurrency Wallets**
    
* **Browser Credentials**
    

The signature **"Created by the one and only M.M."** is embedded, providing a crucial lead.

### Tracing MM on GitHub

Searching for `"Created by the one and only M.M."` on GitHub reveals repositories linked to **MM's handle**.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1733610133711/b780c809-9d17-491e-97a3-26f652b69100.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1733610227573/0ac8f5a7-d7df-4544-a4e9-4ecf9738db5e.png align="center")

This OPSEC failure leads us to incriminating evidence:

1. MM’s GitHub activity reveals their involvement.
    
2. A single commit in the repository exposes their role in crafting the malicious script.
    

### The Lessons: OPSEC and Attribution

This case underscores the importance of **Operational Security (OPSEC)** for both attackers and defenders. Some common mistakes include:

* Reusing handles or email addresses.
    
* Including identifiable metadata in code.
    
* Failing to anonymize online activities.
    

### Real-World OPSEC Fails

1. **AlphaBay Admin Takedown:** Reused email and usernames linked Alexandre Cazes to the dark web marketplace.
    
2. **APT1 Chinese Hackers:** Predictable naming and time-based patterns exposed their identity.
    

### Conclusion

This investigation highlights how seemingly minor breadcrumbs can unravel a malicious actor's identity.