Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Finding Gozi: Answers to Unit 42 Wireshark Quiz, March 2023

Summary: Unit 42 published the answers to its March 2023 Wireshark quiz, which walks through a pcap of Gozi (ISFB/Ursnif) post-infection traffic in an Active Directory environment, based on previously reported activity from March 6, 2023. The infection chain starts with an HTTP GET to unapromo[.]com for /mise/Cliente.zip, whose internet shortcut points to a file URL that generates SMB traffic over TCP port 445 to 46.8.19[.]32\mise\server.exe, while Gozi C2 traffic uses encoded HTTP GET and POST requests over port 80 to IP addresses rather than domains.

What you should know: The quiz notes that many organizations lack full packet capture, so their security staff may never develop the pcap skills this exercise teaches - and Gozi's C2 hides in plain HTTP on port 80 with base64-laden URLs that look like ordinary web traffic.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Identity & Access Management
Related