Blue Team Labs The Planet’s Prestige Writeup: Email Header and Attachment Analysis
A Blue Team Labs Online The Planet’s Prestige walkthrough covering email service identification, Reply-To analysis, Base64 attachment recovery, metadata, and hidden spreadsheet clues.
The Planet's Prestige is a Blue Team Labs Online investigation built around a suspicious email sent after a disappearance. The solve path is a classic email-forensics workflow: inspect headers, recover an encoded attachment, identify the real file type, extract metadata, and inspect an Office document for hidden content.
Description
CoCanDa's Planetary President lost his daughter after a series of abductions. A representative later received an email, and that message became the primary evidence source.
What is the email service used by the malicious actor?
I reviewed the message source and headers. The sending service was visible in the mail metadata.
Answer: emkei.cz
What is the Reply-To email address?
The Reply-To field provided an address controlled by the malicious actor and later helped identify the probable command-and-control domain.
Answer: negeja3921@pashter.com
What is the filetype of the received attachment?
The attachment data was Base64 encoded. I copied the encoded blob into a text file and decoded it locally, then identified the resulting file by content rather than trusting the name.
base64 -d de.txt > test.pdf
Answer: .zip
What is the name of the malicious actor?
After extracting the recovered artifact, I used ExifTool against the suspicious file. The metadata exposed the actor name.
exiftool GoodJobMajor
Answer: Pestero Negeja
What is the location of the attacker in this Universe?
The spreadsheet contained hidden text. Changing the font color in Sheet 3 made the concealed clue readable.
Answer: The Martian Colony, Beside Interplanetary Spaceport.
What could be the probable C&C domain?
The Reply-To address gave the domain most likely used to control the attacker's autonomous bots.
Answer: pashter.com
Key Takeaways
- Email headers and Reply-To fields can expose attacker-controlled services and domains.
- Base64 attachments should be decoded and identified by file signature.
- Office files can hide evidence with formatting tricks such as white text or hidden sheets.