Answers to Unit 42 Wireshark Quiz, January 2023
Summary: Unit 42 published the answers to its January 2023 Wireshark quiz, built on a packet capture of Agent Tesla-style activity from a possible OriginLogger infection found Thursday, Jan. 5, 2023. The pcap shows an infected Windows host at 192.168.1[.]27, named DESKTOP-WIN11PC, relaying stolen data over unencrypted SMTP from one email address to another that collects similar data from other infected hosts.
What you should know: The stolen data included credentials saved by the victim's Thunderbird and Microsoft Edge, plus the host's operating system, Windows account name, CPU, RAM and public IP address - and it left the network in plain SMTP that anyone on the path could read. Unit 42 notes many organizations lack full packet capture, so the people who would need to spot this traffic often have no way to see it.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026