Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Red Line Stealer: Answers to Unit 42 Wireshark Quiz

Summary: Unit 42 published answers to its Wireshark quiz on a July 2023 RedLine Stealer packet capture from an Active Directory environment, tracing the infection from three unencrypted HTTP GET requests to command-and-control traffic over TCP port 12432 to 194.26.135[.]119. The analysis shows the C2 server instructing the malware to search the victim's desktop, Documents folder and AppData for text files, Word documents, cryptocurrency wallet files and browser extensions, and the infected host sending back a desktop screenshot, running process list, hardware information, Edge browser credentials and a file named Top_secret_ducment.docx.

Key Takeaway: The malware pulled stored login credentials from the Edge browser and swept for cryptocurrency wallet files and API keys across installed applications, then sent a screenshot of the desktop to the C2 server - a single infected host handing over the credentials and wallet material that sit on it.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Identity & Access Management
Related