Quick Malware Analysis: SMARTAPESG / NETSUPPORT RAT / STEALC pcap from 2025-03-26

Thanks to Brad Duncan for sharing this pcap from 2025-03-26 on his malware traffic analysis site! Due to issues with Google flagging a warning for the site, we're not including the actual hyperlink but it should be easy to find.

We did a quick analysis of this pcap using Security Onion 2.4.150:

https://blog.securityonion.net/2025/05/security-onion-24150-celebrating.html

If you'd like to follow along, you can do the following:

• install Security Onion 2.4.150 in a VM:
  https://docs.securityonion.net/en/2.4/first-time-users.html
• import the pcap using the SOC Grid interface:
  https://docs.securityonion.net/en/2.4/grid.html#icons-in-lower-left-corner
• optionally enable the DNS lookups feature:
  https://docs.securityonion.net/en/2.4/soc-customization.html?#reverse-dns-lookups

The screenshots at the bottom of this post show some of the interesting alerts, metadata logs, and session transcripts. Want more practice? Check out our other Quick Malware Analysis posts at:

https://blog.securityonion.net/search/label/quick%20malware%20analysis

About Security Onion

Security Onion is a versatile and scalable platform that can run on small virtual machines and can also scale up to the opposite end of the hardware spectrum to take advantage of extremely powerful server-class machines.  Security Onion can also scale horizontally, growing from a standalone single-machine deployment to a full distributed deployment with tens or hundreds of machines as dictated by your enterprise visibility needs. To learn more about Security Onion, please see:
https://securityonion.net

Screenshots

First, we start with the overview of all alerts and logs:

Next, let's focus on just the alerts. We start off in the default aggregated view:

For each of these aggregated alerts, let's drill down and see more detail about the individual alerts and the AI Summary on the right side:

Now that we've reviewed the alerts, let's review the network protocol metadata provided by Zeek:

Weird protocol anomalies:

Software determined by User Agent string:

Dynamic Protocol Detection errors:

QUIC traffic:

Windows Portable Executable (PE) files:

Zeek notices:

x509 logs for TLS/SSL traffic:

HTTP traffic:

Drilling into the HTTP POST requests and pivoting to PCAP transcript, we see:

Scrolling down, we see some base64 encoded uploads, so let's send those to CyberChef and decode them to see what kind of victim information was sent to the attacker:

DNS lookups:

File transfers:

SSL/TLS traffic:

All network connections:

Security Onion Documentation printed book now updated for Security Onion 2.4.150!

We've been offering our Security Onion documentation in book form on Amazon for a few years and it's now been updated for the recently released Security Onion 2.4.150!

Thanks to Richard Bejtlich for writing the inspiring foreword!

Proceeds go to the Rural Technology Fund!

This edition has been updated for Security Onion 2.4.150 and includes a 20% discount code for our on-demand training and certification!

This book covers the following Security Onion topics:

• First Time Users
• Getting Started
• Security Onion Console (SOC)
• Security Onion Desktop
• Network Visibility
• Additional Network Visibility
• Host Visibility
• Third Party Integrations
• Rules
• Logs
• Updating
• Accounts
• Services
• Customizing for Your Environment
• Tricks and Tips
• Utilities
• Help

Q&A

What is the difference between this book and the online documentation?

This book is the online documentation formatted specifically for print. It also includes an inspiring foreword by Richard Bejtlich that is not available anywhere else! Proceeds go to the Rural Technology Fund! Finally, the printed book includes a 20% discount code for our on-demand training and certification.

Who should get this book?

You should get this book if you work on airgap networks or simply want a portable reference that doesn't require an Internet connection or batteries! Also anyone who wants to donate to a worthy cause like Rural Technology Fund!

What is the difference between this edition and the previous edition?

This edition has been updated for Security Onion 2.4.150!

Where do we get it?

https://securityonion.com/book

Security Onion Conference 2025 Save the Date and CFP

This year's Security Onion Conference is currently scheduled to be held in person in Augusta, GA on Friday, October 24, 2025. Registration will open August 7.

CFP

Want to speak at Security Onion Conference? We want to hear from you!

How are you...

...using Security Onion to find evil?

...handling lots of traffic and logs using Security Onion?

...integrating Security Onion with other technologies?

...automating common tasks with your own scripts?

...using Security Onion in a unique way?

Each talk should be 45 minutes, including time for questions. Submit your talk here:
https://securityonion.net/cfp

Schedule

May 19 - CFP open

July 14 - CFP closes

August 7 - Speakers selected and notified

August 7 - Registration opens at Noon Eastern Time

October 20 through October 23 - Security Onion 4-day training in Augusta

October 24 - Security Onion Conference

October 25 - BSidesAugusta

Previous Conferences

Want to see talks from previous Security Onion Conferences?

https://securityonion.net/conf

Security Onion 2.4.150: Celebrating Mother's Day with MoM (Manager of Managers)

Yesterday was Mother's Day and we are very thankful for our mothers! Today, we are releasing Security Onion 2.4.150 which includes a new Pro feature called MoM (Manager of Managers).

 If you have multiple Security Onion deployments, you'll want to check out this new feature as it will allow you to manage all of them from a single manager!

You can read more about Manager of Managers in the MoM section of the documentation:

https://docs.securityonion.net/en/2.4/mom.html

Elasticsearch Deletion Changes

As we mentioned in a previous blog post, this release includes changes for the Elasticsearch deletion process:

https://blog.securityonion.net/2025/04/upcoming-change-to-elasticsearch-index.html

Elasticsearch indices are managed by both the so-elasticsearch-indices-delete utility and Index Lifecycle Management (ILM). so-elasticsearch-indices-delete is primarily designed for single-node deployments like EVAL and STANDALONE configurations. Running it on a multi-node deployment with one or more search nodes has the possibility of getting into a corner case state where more data is deleted than intended. Because of this, we will disable this script on multi-node deployments when you update to this 2.4.150 release.

You will need to ensure that ILM is configured properly to delete indices before disk usage reaches the Elasticsearch watermark setting. Otherwise, Elasticsearch may stop ingesting new data. For more information, please see:

https://docs.securityonion.net/en/2.4/elasticsearch.html#index-management

Release Notes

There are many more features and fixes included in this release! For a complete list of all changes, please see the Release Notes:

https://docs.securityonion.net/en/2.4/release-notes.html#changes

Known Issues

For a list of known issues, please see:

https://docs.securityonion.net/en/2.4/release-notes.html#known-issues

About Security Onion

Security Onion is a free and open platform built by defenders for defenders. It includes network visibility, host visibility, intrusion detection honeypots, log management, and case management. 

For network visibility, we offer signature based detection via Suricata, rich protocol metadata and file extraction using your choice of either Zeek or Suricata, full packet capture, and file analysis. For host visibility, we offer the Elastic Agent which provides data collection, live queries via osquery, and centralized management using Elastic Fleet. Intrusion detection honeypots based on OpenCanary can be added to your deployment for even more enterprise visibility. All of these logs flow into Elasticsearch and we’ve built our own user interfaces for alerts, dashboards, threat hunting, case management, and grid management. 

Security Onion has been downloaded over 2 million times and is being used by security teams around the world to monitor and defend their enterprises. Our easy-to-use Setup wizard allows you to build a distributed grid for your enterprise in minutes!

Documentation

You can find our online documentation here:

https://docs.securityonion.net/en/2.4/

Documentation is always a work in progress. If you find documentation that needs to be updated, please let us know as described in the Feedback section below.

New Installations

If this is your first time installing Security Onion 2.4, then we highly recommend starting with an IMPORT installation as shown at:

https://docs.securityonion.net/en/2.4/first-time-users.html

Once you’re comfortable with your IMPORT installation, then you can move on to more advanced installations as shown at:

https://docs.securityonion.net/en/2.4/architecture.html

Existing 2.4 Installations

If you have an existing Security Onion 2.4 installation, you can update to the latest version using soup:

https://docs.securityonion.net/en/2.4/soup.html

Before updating your production deployment, we highly recommend testing the upgrade process on a test deployment that closely matches your production deployment if possible. This is especially important for releases that update components like Salt and Elastic.

2.3 EOL

As a reminder, Security Onion 2.3 reached End Of Life (EOL) on April 6, 2024:

https://blog.securityonion.net/2023/10/6-month-eol-notice-for-security-onion-23.html

Thanks

Lots of love went into this release!

Special thanks to all our folks working so hard to make this release happen!

• Josh Brower
• Jason Ertel
• Corey Ogburn
• Josh Patterson
• Mike Reeves
• Jorge Reyes

Questions, Problems, and Feedback

If you have any questions or problems relating to Security Onion 2.4, please use the 2.4 category at our Discussions site:

https://github.com/Security-Onion-Solutions/securityonion/discussions/categories/2-4

Security Onion Pro

We recently celebrated 10 years in business by announcing Security Onion Pro:

https://blog.securityonion.net/2024/07/celebrating-10-years-of-security-onion.html

Security Onion Pro includes many enterprise features that folks have been asking for:

• Active Query Management
• External API
• Open ID Connect (OIDC)
• Data at Rest Encryption
• FIPS for the OS
• DoD STIG for the OS
• External Notifications in SOC
• Time Tracking inside of Cases
• Guaranteed Message Delivery
• Manager of Managers

You can read more about these enterprise features at:

https://securityonion.com/pro

Training

Need training? Start with our free Security Onion Essentials training and then take a look at some of our other official Security Onion training!

https://securityonion.net/training

Security Onion Solutions Hardware Appliances

We know Security Onion's hardware needs, and our appliances are the perfect match for the platform. Leave the hardware research, testing, and support to us, so you can focus on what's important for your organization. Not only will you have confidence that your Security Onion deployment is running on the best-suited hardware, you will also be supporting future development and maintenance of the Security Onion project!

https://securityonion.com/hardware

Cloud Installations

For new Security Onion 2 installations in the cloud, this new version will soon be available on the AWS, Azure, and GCP marketplaces!

AWS Marketplace and Documentation:

https://securityonion.net/aws/?ref=_ptnr_soc_blog_250512

https://docs.securityonion.net/en/2.4/cloud-amazon.html

Azure Marketplace and documentation:

https://securityonion.net/azure

https://docs.securityonion.net/en/2.4/cloud-azure.html

GCP Marketplace and documentation:

https://securityonion.net/google

https://docs.securityonion.net/en/2.4/cloud-google.html

Screenshot Tour

If you want the quickest and easiest way to try out Security Onion 2.4, just follow the screenshots below to install an Import node. This can be done in a minimal VM with only 4GB RAM! For more information, please see:

https://docs.securityonion.net/en/2.4/first-time-users.html