#WIRESHARK HTTPS GIBBERISH WINDOWS#

Now we see that the client has made a request and the server responded but there’s something wrong. With the filter in place we right click on the first packet, then select the options Follow > HTTP Stream to follow the HTTP traffic stream of the first packet. Now let’s take a closer look and the actual data of the conversation. In the fourth packet, we can see that a file was sent and downloaded to the desktop device. If we look at the info of the first packet, we see an interesting parameter name= with the value of a name. We can find the IP of petparadise, by looking at the lower section with the Internet Protocol Version 4 tab and then use it to create a filter. Let’s first look at the first result and make a filter between the compromised machine and petparadizebiz.

The second is HTTP traffic from the site from port 80 to port 62,731 in the local machine. The first is HTTP traffic from device DESKTOP-PZKSV1P.local (10.1.11.101) to the website petparaisebiz. So the first thing we can do is check HTTP since it is always an interesting protocol to look at because the web traffic that passes through that port is unencrypted.

#WIRESHARK HTTPS GIBBERISH WINDOWS#

Don’t visit any of the links and be very careful if you’re following along and using Windows because the malware is Windows based. Using Wireshark to Examine Emotet Network Activityīefore we begin, a word of warning. If you’re interested, you can watch a video of the raid here (YouTube - Ukraninan). Unfortuantely, it became apperant that the raid was only a minor set back and in December of 2021, there was a huge spike in Emotet activity. The raid had included the seizure of back up drives making law enforcement hopeful that this would prevent Emotet from coming back. In January of 2021, a coalition of law enforcement agencies in Europe along with the US, Canada, and private security researchers under Europol announced a raid that had disrupted Emotet and arrested at least two members. The operators are skilled in spam filter evasion and would use compromised email servers to send mass emails and spread in a organization’s network to gain control of more machines. Dutch police estimated that Emotet has caused hundreds of millions of dollars in damages while the Ukranian police has made an estimate to around 2.5 billion USD in damages.Įmotet spreads mainly through spam email containing malicious links and documents with tainted Microsoft Office macros. Emotet is known by many cybercriminals as the operators of the malware would partner with other cybercriminals and work to distribute various malware globally such as ransomware or to even sell access to data thieves.

Brief History of Emotetįirst discovered in 2014, Emotet began as a banking trojan and then evolved into a more sophisticated trojan that would act as a downloader for other malware.

For this post, I will be analysing a pcap file of Emotet actvity on a network. It is a site that collects network logs from malware so it is good if you’re also looking to practice network analysis and malware analysis. While searching for pcap files to analyze, I came across the site. In this post I will be showing you how I analyzed emotet malware in a network log using Wireshark and hopefully this will help you give an idea of what to do and look for when analyzing a network log using Wireshark.

Wireshark https gibberish