Security Onion: Quick Malware Analysis: SMARTAPESG / NETSUPPORT RAT / STEALC pcap from 2025-03-26

Thanks to Brad Duncan for sharing this pcap from 2025-03-26 on his malware traffic analysis site! Due to issues with Google flagging a warning for the site, we're not including the actual hyperlink but it should be easy to find.

We did a quick analysis of this pcap using Security Onion 2.4.150:

https://blog.securityonion.net/2025/05/security-onion-24150-celebrating.html

If you'd like to follow along, you can do the following:

install Security Onion 2.4.150 in a VM:
https://docs.securityonion.net/en/2.4/first-time-users.html
import the pcap using the SOC Grid interface:
https://docs.securityonion.net/en/2.4/grid.html#icons-in-lower-left-corner
optionally enable the DNS lookups feature:
https://docs.securityonion.net/en/2.4/soc-customization.html?#reverse-dns-lookups

The screenshots at the bottom of this post show some of the interesting alerts, metadata logs, and session transcripts. Want more practice? Check out our other Quick Malware Analysis posts at:

https://blog.securityonion.net/search/label/quick%20malware%20analysis

About Security Onion

Security Onion is a versatile and scalable platform that can run on small virtual machines and can also scale up to the opposite end of the hardware spectrum to take advantage of extremely powerful server-class machines. Security Onion can also scale horizontally, growing from a standalone single-machine deployment to a full distributed deployment with tens or hundreds of machines as dictated by your enterprise visibility needs. To learn more about Security Onion, please see:
https://securityonion.net

Screenshots

First, we start with the overview of all alerts and logs:

Next, let's focus on just the alerts. We start off in the default aggregated view:

For each of these aggregated alerts, let's drill down and see more detail about the individual alerts and the AI Summary on the right side:

Now that we've reviewed the alerts, let's review the network protocol metadata provided by Zeek:

Weird protocol anomalies:

Software determined by User Agent string:

Dynamic Protocol Detection errors:

QUIC traffic:

Windows Portable Executable (PE) files:

Zeek notices:

x509 logs for TLS/SSL traffic:

HTTP traffic:

Drilling into the HTTP POST requests and pivoting to PCAP transcript, we see:

Scrolling down, we see some base64 encoded uploads, so let's send those to CyberChef and decode them to see what kind of victim information was sent to the attacker: