@netresec.com.bsky.social
Experts in Network Forensics and Network Security Monitoring. Creators of #NetworkMiner, #CapLoader, PacketCache, #PolarProxy and RawCap. Website: https://www.netresec.com/ Mastodon: @netresec@infosec.exchange
π§ Dropper connects to legitimate website
π Fake PDF is downloaded over HTTPS
πΎ Fake PDF is decrypted to a #PureLogs DLL
βοΈ InstallUtil.exe or RegAsm.exe is started
π PureLogs DLL is injected into the running process
πΎ PureLogs connects to C2 server
netresec.com?b=257eead
CapLoader 2.0.1 Released
β οΈ IP lookup alert
π Better protocol identification
π Bug fixes
netresec.com?b=2571527
Turns out this is Interlock RAT
malpedia.caad.fkie.fraunhofer.de/details/win....
Does anyone know what malware this is? C2 is on 104.16.0.0/13 (CloudFlare).
C2 domains:
π₯ event-time-microsoft[.]org
π₯ windows-msgas[.]com
π₯ event-datamicrosoft[.]live
π₯ eventdata-microsoft[.]live
PCAP from @malware-traffic-analysis.net
infosec.exchange/@netresec/11...
Video: Detecting #PureLogs C2 traffic with #CapLoader
netresec.com?b=256a8c4
CapLoader 2.0 released today!
π Identifies over 250 protocols in #PCAP
π¨ Define protocols from example traffic
πΆ Extracts JA3, JA4 and SNI from QUIC
π» 10x faster user interface
netresec.com?b=256dbbc
![Many organizations may not need to allow outgoing traffic to hosting and API mocking services, which are frequently used by GRU unit 26165. Organizations should consider alerting on or blocking the following services, with exceptions allowlisted for legitimate activity [D3-DNSDL].
*.000[.]pe
*.1cooldns[.]com
*.42web[.]io
*.4cloud[.]click
*.accesscan[.]org
*.bumbleshrimp[.]com
*.camdvr[.]org
*.casacam[.]net
*.ddnsfree[.]com
*.ddnsgeek[.]com
*.ddnsguru[.]com
*.dynuddns[.]com
*.dynuddns[.]net
*.free[.]nf
*.freeddns[.]org
*.frge[.]io
*.glize[.]com
*.great-site[.]net
*.infinityfreeapp[.]com
*.kesug[.]com
*.loseyourip[.]com
*.lovestoblog[.]com
*.mockbin[.]io
*.mockbin[.]org
*.mocky[.]io
*.mybiolink[.]io
*.mysynology[.]net
*.mywire[.]org
*.ngrok[.]io
*.ooguy[.]com
*.pipedream[.]net
*.rf[.]gd
*.urlbae[.]com
*.webhook[.]site
*.webhookapp[.]com
*.webredirect[.]org
*.wuaze[.]com
Heuristic detections for web requests to new subdomains, including of the above providers, may uncover malicious phishing activity [D3-DNRA]. Logging the requests for each sub-domain requested by users on a network, such as in DNS or firewall logs, may enable system administrators to identify new targeting and victims.](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:2qrgzoyfwkguclususquvdz2/bafkreidsg3ldjaxglxhetka5xmbm2gc7xlthvuyoek2vmeo6ny5tsdi3di@jpeg)
Many organizations may not need to allow outgoing traffic to hosting and API mocking services, which are frequently used by GRU unit 26165. Organizations should consider alerting on or blocking the following services, with exceptions allowlisted for legitimate activity [D3-DNSDL]. *.000[.]pe *.1cooldns[.]com *.42web[.]io *.4cloud[.]click *.accesscan[.]org *.bumbleshrimp[.]com *.camdvr[.]org *.casacam[.]net *.ddnsfree[.]com *.ddnsgeek[.]com *.ddnsguru[.]com *.dynuddns[.]com *.dynuddns[.]net *.free[.]nf *.freeddns[.]org *.frge[.]io *.glize[.]com *.great-site[.]net *.infinityfreeapp[.]com *.kesug[.]com *.loseyourip[.]com *.lovestoblog[.]com *.mockbin[.]io *.mockbin[.]org *.mocky[.]io *.mybiolink[.]io *.mysynology[.]net *.mywire[.]org *.ngrok[.]io *.ooguy[.]com *.pipedream[.]net *.rf[.]gd *.urlbae[.]com *.webhook[.]site *.webhookapp[.]com *.webredirect[.]org *.wuaze[.]com Heuristic detections for web requests to new subdomains, including of the above providers, may uncover malicious phishing activity [D3-DNRA]. Logging the requests for each sub-domain requested by users on a network, such as in DNS or firewall logs, may enable system administrators to identify new targeting and victims.
Thank you CISA, @ncsc.gov.uk, @bsi.bund.de et al. for publishing the advisory on Russian GRU Targeting Western Logistics Entities and Technology Companies. This list of mocking services is great for threat hunting!
www.cisa.gov/news-events/...
Correct link should be
darknetdiaries.com/episode/158/
JPG and EML files extracted from SMTP traffic by NetworkMiner 3.0
NetworkMiner automatically extracts EML files as well as attachments (here a jpg image) to disk when it parses emails in SMTP, POP3 or IMAP traffic.
06.05.2025 06:25 β π 1 π 0 π¬ 0 π 0Yes! Wireshark's "Export Packet Bytes" feature can also be used to extract files inside of other data structures, such as attachments in emails.
06.05.2025 06:15 β π 0 π 0 π¬ 1 π 0
Comparison of tools that extract files from #PCAP
π #Chaosreader
βοΈ #NetworkMiner
πΏοΈ #Suricata
π #tcpflow
π¦ #Wireshark
ποΈ #Zeek
netresec.com?b=255329f
Did you know that NetworkMiner parses the #njRAT protocol? The following artefacts are extracted from njRAT C2 traffic:
π₯οΈ Screenshots of victim computer
π Transferred files
πΎ Commands from C2 server
π€ Replies from bot
π Stolen credentials/passwords
β¨οΈ Keylog data
netresec.com?b=2541a39
LOL, Greenland has been a part of the Kingdom of Denmark since before USA even existed as a country!
10.04.2025 09:11 β π 1 π 0 π¬ 1 π 0
New instructions for installing NetworkMiner on Linux
netresec.com?b=2542784
NetworkMiner 3.0 Released!
π QUIC
π CIP (EtherNet/IP)
π UMAS (over Mobdus)
πΎ Remcos RAT
π Improved OS fingerprinting
π§ Better Linux integration
netresec.com?b=254caa9
How to set #PCAP as default savefile format in #Wireshark
π Edit
π Preferences
π‘ Advanced
βοΈ Change capture.pcap_ng to FALSE
netresec.com?b=2523d40
Setting capture.pcap_ng to FALSE in Wireshark's Edit, Preferences, Advanced let's you save capture files as .pcap instead of .pcapng as default.
That's a very useful feature! Thanks for sharing π
24.02.2025 10:20 β π 2 π 0 π¬ 0 π 0
Here's a feature request to have #Wireshark bring back PCAP as the default savefile format instead of pcapng.
gitlab.com/wireshark/wi...
PolarProxy 1.0.1 Released
π More #JA4
π Fail-open on #TLS errors
β© Better performance
netresec.com?b=2523c96
Neat, just found out that @synacktiv.com are on Bluesky as well! Linking their original bsky post here.
29.01.2025 15:20 β π 1 π 0 π¬ 0 π 0
dns.βqry.βname should have the same value as dns.βresp.βname Here's a Wireshark display filter for you: dns.count.answers > 0 and lower(dns.qry.name) == lower(dns.resp.name)
Here's a Wireshark display filter that detects this type of LLMNR (multicast name resolution) spoofing:
dns.βcount.βanswers > 0 and lower(dns.βqry.βname) != lower(dns.βresp.βname)
This is an interesting Kerberos relay attack! It leverages LLMNR spoofing/poisoning to trick victims to connect to the attacker's machine and authenticate using Kerberos.
29.01.2025 15:09 β π 3 π 1 π¬ 1 π 0Filtering on the domain name is quicker since only the client request is needed to extract the hostname from the SNI extension.
27.01.2025 11:50 β π 0 π 0 π¬ 0 π 0Interesting idea π€ That would technically be doable. One drawback is that the TLS firewall will have to wait for the server certificate before deciding whether to block it or not.
27.01.2025 11:50 β π 1 π 0 π¬ 1 π 0
A TLS firewall is similar to a DNS firewall, except it blocks connections to unwanted websites even if the DNS traffic is encrypted.
netresec.com?b=2515cf0
Covered Topics:
πΎ C2 traffic analysis
π Analyzing decrypted HTTPS traffic
βοΈ Lateral movement
π― Threat Hunting
π JA3 and JA4
π Passive DNS
#DFIR #PCAP
Weβve now scheduled our next Network Forensics for Incident Response training
π
Dates: May 12-15, 2025
π Duration: Four half-days
π Type: Live Online Network Forensics Training
π΅ Price: β¬ 960 EUR
www.netresec.com?page=Training
bsky.app/profile/Goss...
18.12.2024 18:27 β π 0 π 0 π¬ 0 π 0
Original source: https://infosec.exchange/@cR0w/113239726857971779
#DirectoryTraversalMemes
18.12.2024 18:14 β π 5 π 0 π¬ 1 π 0Can you elaborate on "making it illegal to share info produced by [Recorded Future"? Would this also apply to info from platforms like Recorded Future's tria.ge ?
18.12.2024 09:31 β π 0 π 0 π¬ 1 π 0
