Analyzing Emotet infections
summary
Shows how Emotet infection proceeds from a malicious Word macro to an initial DLL download, then encrypted HTTP command‑and‑control and spambot modules; demonstrates using Wireshark (version 3) to find and export binaries via pcaps available at malware-traffic-analysis.net, to follow TCP streams and use File > Export Objects > HTTP, and to spot http POSTs to IPs with encoded C2 and SMTP over port 25/465/587. Includes five real pcaps, example sizes (a ~6.3 KB exfiltration), and confirms spambot SMTP traffic is observed and working.
AI-written summary · about
chapters (8)
- 0:00Introduction to Emotet
- 4:18Emotet infection chain
- 5:02Emotet's final days
- 13:50Example infection traffic
- 29:27Trickbot and spambot activity
- 34:57Unusual HTTPS traffic
- 40:25Spambot activity analysis
- 43:14Q&A and closing remarks
related talks
50mEmotet Exposed: Insider the Cybercriminal's Supply Chain
42mStart Covering Your Bases And Stop Chasing APT Headlines
49mThe State Of Malware From The Eye Of The Tiger
43mMalicious Payloads vs Deep Visibility: A PowerShell Story
25mCommSec D1 - A Deep Dive Into Malicious Documents
52mRansomware 101: Get Smart Understanding Real Attacks
40mLearning from the Enemy: A Look Inside the Techniques of Ocean Lotus /APT32
51mWanna Get Malware Out of Emails? CISA’s Latest Research