Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Wireshark Tutorial: Examining Dridex Infection Traffic

Summary: Unit 42's Wireshark tutorial walks through five password-protected pcap archives of Dridex traffic, a banking Trojan and information stealer active since 2014 and distributed through malspam waves two or three times a week. The tutorial shows that post-infection command and control runs over HTTPS directly to IP addresses with self-signed certificates whose issuer fields carry random strings but matching country and locality values, such as Vanuatu's Vu and Port Vila or Angola's AO and Luanda.

What's compelling: Dridex C2 hides behind HTTPS to bare IP addresses, so domain-based blocking and URL logging will not surface it; the certificate issuer fields are the tell, and one certificate seen on 62.98.109[.]30 on Sept. 24, 2020 reappeared on 144.202.31[.]138 by Sept. 29, meaning the same infrastructure keeps serving new infections.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related