Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Wireshark Tutorial: Examining Emotet Infection Traffic

Summary: Unit 42's Wireshark tutorial walks through five pcaps of recent Emotet infections, showing how the malware's initial DLL is retrieved over HTTP GET requests, with C2 traffic carried in HTTP POST requests that end either in HTTP/1.1 or in HTTP/1.1 (application/x-www-form-urlencoded). Since Dec. 21, 2020, the initial Emotet binary has been a Windows DLL rather than an EXE, and infected hosts can also become spambots generating SMTP traffic on TCP ports 25, 465 and 587.

What's compelling: One example pcap captures 4 minutes and 42 seconds of spambot activity totaling over 21 MB, and most of those messages are hidden inside encrypted SMTP tunnels - meaning an infected host can be sending malspam at volume while your mail logs show only TLS.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related