Layer I · Encoding
Loading
Hints
Case file · MOTHWING 2.4.1
Five layers to the C2
A stealer's configuration was recovered from a memory dump. Five layers stand between you and the operator's C2.
Each answer is the key to the next layer: the page cannot show you layer II until you give it the campaign id from layer I, so there is nothing to find in the source. MOTHWING is fictional and every byte here is synthetic. Hosts come from reserved documentation ranges and are shown defanged. The workbench runs entirely in your browser; nothing you paste leaves it.
5 layers · 0 solved
core · locked
core · locked
Each layer is a planet. Solve one and it lights, and the next orbit draws in. The core opens when all five are down.
The core · unlocked
Config recovered
Time0:00
Hints0
The LummaC2, Vidar and DarkGate writeups on the light orrery take the same layers apart in real samples.
Workbench
A small CyberChef. Chain operations, reorder them, switch them off. The recipe lives in the address bar, so a link shares it. Nothing here touches the network.
0 bytes
No steps yet. Add an operation above: each one feeds the next, top to bottom.