Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Answers to Unit 42 Wireshark Quiz, February 2023

Summary: Unit 42's February 2023 Wireshark quiz walks through a pcap from a simulated Active Directory environment in which a Windows host at 10.0.0[.]149, used by Damon Bauer, was infected with Qakbot on 2023-02-03 at 17:04 UTC after an HTTP GET request to 128.254.207[.]55 for 86607.dat. The analysis identifies three Qakbot command-and-control servers, TCP port 65400 traffic to 23.111.114[.]52, and probable spambot activity contacting at least 25 email servers in roughly 19 to 20 minutes.

Why it matters: Qakbot has most recently been associated with the Black Basta ransomware gang, which uses tools like Cobalt Strike to gain a foothold and move laterally once a host is infected.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Identity & Access Management
Related