Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Wireshark Tutorial: Examining Ursnif Infections

Summary: Unit 42's tutorial walks through four Wireshark pcaps of Ursnif (also called Gozi or IFSB) infections, showing HTTP GET requests with /api1/ and /images/ URL patterns, HTTPS certificate issuer data that is not valid, and a DNS lookup to myip.opendns.com that returns the infected host's public IP address. The third and fourth pcaps add decoy traffic to google.com and gmail.com, failed 404 responses from ghdy656262oe[.]com before a 200 OK, and an encrypted .rar download from carresqautomotive[.]com carrying follow-up malware such as Dridex, IcedID, Nymain, Pushdo, or Trickbot.

Bottom line: Ursnif hides its real command traffic behind decoy requests to Google and Gmail and uses a legitimate OpenDNS resolver to learn the victim's public IP, so a detection strategy built on blocking known-bad domains alone will miss the infection while the follow-up malware arrives encrypted in a .rar file.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related