Unit 42 Wireshark Quiz, January 2023
Summary: Unit 42 published a January 2023 Wireshark quiz built on a packet capture of Agent Tesla-style activity from a possible OriginLogger infection that Unit 42 flagged on Twitter on Thursday, Jan. 5, 2023. The pcap contains HTTP traffic of an obfuscated binary that decodes to a malicious DLL, plus unencrypted SMTP traffic carrying data stolen from a stand-alone Windows client populated with fake login credentials.
Bottom line: The stolen data left the infected host in unencrypted SMTP, so anyone positioned on the network path could read it - and the sample's credentials were fake only because Unit 42 planted them before running the malware.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026