#Wireshark filters pdf#
#Wireshark filters update#
#Wireshark filters archive#
#Wireshark filters zip#
#Wireshark filters download#

Since Emotet is also a malware dropper, the victim may become infected with other malware.

#Wireshark filters update#

This C2 activity also consists of data exfiltration and traffic to update the initial Emotet binary. This C2 activity can use either standard or non-standard TCP ports associated with HTTP traffic. Previously, this binary had been a Windows EXE file.Įmotet C2 traffic consists of encoded or otherwise encrypted data sent over HTTP. 21, 2020, the initial binary for Emotet has been a Windows DLL file.

SMTP traffic if Emotet uses the infected host as a spambot.įigure 3 shows a flowchart of network activity we might find during an Emotet infection.

Additional infection traffic if Emotet drops follow-up malware.

Encoded/encrypted command and control (C2) traffic over HTTP.

Web traffic to retrieve the initial binary.

Various distribution paths for an Emotet Word document.Īfter the Word document is delivered, if a victim opens the document and enables macros on a vulnerable Windows host, the host is infected with Emotet.įrom a traffic perspective, we see the following steps from an Emotet Word document to an Emotet infection:

#Wireshark filters pdf#

In previous years, malspam pushing Emotet has also used PDF attachments with embedded links to deliver these Emotet Word documents.įigure 2 illustrates these four distribution techniques.

#Wireshark filters download#

Instead, they contain a link to download the Word document. Some emails distributing Emotet do not have any attachments.

#Wireshark filters zip#

In recent months, we have seen several examples where these ZIP archives are password-protected.

#Wireshark filters archive#

The malspam may contain an attached Microsoft Word document or have an attached ZIP archive containing the Word document. Malspam spreading Emotet uses different techniques to distribute these Word documents. Screenshot of a Word document used to cause an Emotet infection in January 2021. The critical step in an Emotet infection chain is a Microsoft Word document with macros designed to infect a vulnerable Windows host. Emotet is commonly distributed through malicious spam (malspam) emails. To understand network traffic caused by Emotet, you must first understand the chain of events leading to an infection. If possible, we recommend you review these pcaps in a non-Windows environment like BSD, Linux or macOS. There is a risk of infection if using a Windows computer. Warning: Some of the pcaps used for this tutorial contain Windows-based malware. You will need to access a GitHub repository with ZIP archives containing the pcaps used for this tutorial.

Note: These instructions assume you have customized Wireshark as described in our previous Wireshark tutorial about customizing the column display. Today’s Wireshark tutorial reviews recent Emotet activity and provides some helpful tips on identifying this malware based on traffic analysis. It has since evolved with additional functions such as a dropper, distributing other malware families like Gootkit, IcedID, Qakbot and Trickbot. Familiarity with Wireshark is necessary to understand this tutorial, which focuses on Wireshark version 3.x.Įmotet is an information-stealer first reported in 2014 as banking malware. Click on Export Objects, and then SMB.This tutorial is designed for security professionals who investigate suspicious network activity and review packet captures (pcaps). To export SMB objects (such as transferred files): SMB is a favorite to capture, as it is usually not encrypted and you may be able to exfiltrate files over the wire. To export FTP objects (such as transferred files): Remember to always Right-Click a packet, and Follow the TCP Stream to get more details from the raw data.įTP is pretty simple, since all traffic is sent in plaintext. To export HTTP objects (such as images or pages): If non-encrypted HTTP traffic was captured, we may be able to extract juicy details. In the Menu, click on Statistics and select Protocol Hierarchy. Understanding the Packet Captureīefore diving too deep, it’s always a good idea to get an idea of what type of traffic was captured so you know which filters to apply. This post will be updated as time goes on. However, I wanted to create this ‘short’ list that contains my favorite go-to’s after performing Man in the Middle attacks. There are literally hundreds of these type of posts on the internet, with one of my favorites being.