Quick Malware Analysis: AGENTTESLA VARIANT USING FTP pcap from 2024-12-04

Thanks to Brad Duncan for sharing this pcap from 2024-12-04 on his malware traffic analysis site! Due to issues with Google flagging a warning for the site, we're not including the actual hyperlink but it should be easy to find.

We did a quick analysis of this pcap using Security Onion 2.4.110:

https://blog.securityonion.net/2024/10/security-onion-24110-hurricane-helene.html

If you'd like to follow along, you can do the following:

• install Security Onion 2.4.110 in a VM:
  https://docs.securityonion.net/en/2.4/first-time-users.html
• import the pcap using the SOC Grid interface:
  https://docs.securityonion.net/en/2.4/grid.html#icons-in-lower-left-corner
• optionally enable the DNS lookups feature:
  https://docs.securityonion.net/en/2.4/soc-customization.html?#reverse-dns-lookups

The screenshots at the bottom of this post show some of the interesting alerts, metadata logs, and session transcripts. Want more practice? Check out our other Quick Malware Analysis posts at:

https://blog.securityonion.net/search/label/quick%20malware%20analysis

About Security Onion

Security Onion is a versatile and scalable platform that can run on small virtual machines and can also scale up to the opposite end of the hardware spectrum to take advantage of extremely powerful server-class machines.  Security Onion can also scale horizontally, growing from a standalone single-machine deployment to a full distributed deployment with tens or hundreds of machines as dictated by your enterprise visibility needs. To learn more about Security Onion, please see:
https://securityonion.net

Screenshots

First, we start with the overview of all alerts and logs:

Next, let's look at just the alerts:

Let's drill into the ET MALWARE AgentTesla Exfil via FTP alert:

Let's pivot to full packet capture for the stream:

Switching to ASCII transcript makes it easier to read:

Let's see the related Zeek FTP logs:

We see the same TCP stream as the alert but we also see a new one so let's pivot to PCAP:

Now let's look at the FTP Data:

Here are the actual files transferred:

Quick Malware Analysis: SNAKE KEYLOGGER (VIP RECOVERY) with FTP EXFIL PCAP from 2024-09-17

Thanks to Brad Duncan for sharing this pcap from 2024-09-17 on his malware traffic analysis site! Due to issues with Google flagging a warning for the site, we're not including the actual hyperlink but it should be easy to find.

We did a quick analysis of this pcap on the NEW Security Onion 2.4.100:

https://blog.securityonion.net/2024/08/security-onion-24100-now-available.html

If you'd like to follow along, you can do the following:

• install Security Onion 2.4.100 in a VM:
  https://docs.securityonion.net/en/2.4/first-time-users.html
• import the pcap using the SOC Grid interface:
  https://docs.securityonion.net/en/2.4/grid.html#icons-in-lower-left-corner
• optionally enable the DNS lookups feature:
  https://docs.securityonion.net/en/2.4/soc-customization.html?#reverse-dns-lookups

The screenshots at the bottom of this post show some of the interesting alerts, metadata logs, and session transcripts. Want more practice? Check out our other Quick Malware Analysis posts at:

https://blog.securityonion.net/search/label/quick%20malware%20analysis

About Security Onion

Security Onion is a versatile and scalable platform that can run on small virtual machines and can also scale up to the opposite end of the hardware spectrum to take advantage of extremely powerful server-class machines.  Security Onion can also scale horizontally, growing from a standalone single-machine deployment to a full distributed deployment with tens or hundreds of machines as dictated by your enterprise visibility needs. To learn more about Security Onion, please see:
https://securityonion.net

Screenshots

First, we start with the overview of all alerts and logs:

Next, we look at just the NIDS alerts generated by Suricata:

Let's drill into the Snake keylogger alert:

This looks interesting so let's pivot to PCAP:

We can switch to ASCII transcript to make it more readable:

Now let's review the protocol metadata provided by Zeek:

We start with the Software dashboard where we see an interesting browser user agent string:

Next, let's review the X.509 dashboard:

and the associated SSL/TLS dashboard:

Next, we'll look at the DNS dashboard:

Looking at the HTTP dashboard, we see the interesting browser user agent we saw earlier on the Software dashboard:

Looking at the Files dashboard, we can see files being transferred by both HTTP and FTP:

Let's review the FTP dashboard. Here we see a couple of files being transferred:

At the bottom of the FTP dashboard, we can see the 2 FTP STOR transactions where files are being exfiltrated:

If we pivot to PCAP, we can see the FTP CONTROL channel:

To see the FTP DATA channel, we can switch to the Connections dashboard:

Pivoting to PCAP, we see one of the exfil files contains the user's browser cookies:

And the second exfil file contains the user's saved passwords:

securityonion-web-page - 20141015-0ubuntu0securityonion60 resolves 2 issues

I've updated the following package:

securityonion-web-page - 20141015-0ubuntu0securityonion60

It should resolve the following issues:

Issue 952: securityonion-web-page: add FTP Data query to FTP category:
https://github.com/Security-Onion-Solutions/security-onion/issues/952

With the current FTP queries in ELSA, if you pivot to full packet capture, you only see the FTP control channel (you don't see actual files being transferred).  This update add a new query to the FTP category to help users to find the FTP data channel where files are actually transferred.

Issue 957: securityonion-web-page: change public site hyperlinks to https
https://github.com/Security-Onion-Solutions/security-onion/issues/957

Our public websites for the Security Onion project and for Security Onion Solutions now default to https, so we're changing all hyperlinks from http to https.

Wes Lambert tested this package.  Thanks, Wes!

Updating
This package is now available in our stable repo.  Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
The next round of online classes is next week!
https://attendee.gototraining.com/9z73w/catalog/8119062504158470144

Conference
Security Onion Conference will be on Friday September 9 and registration is open!
https://securityonion.net/conference

Support
Need support?  Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

New securityonion-web-page package adds a BRO_FTP query and some BRO_INTEL queries

I've updated our securityonion-web-page package to add a BRO_FTP query and also some BRO_INTEL queries for our recently added BRO_INTEL parsers:
http://blog.securityonion.net/2014/03/new-securityonion-elsa-extras-and.html

The updated package version is as follows:
securityonion-web-page - 20120722-0ubuntu0securityonion21

This new package has been tested by the following (thanks!):
Eddy Simons
David Zawdie

Issues Resolved

Issue 506: securityonion-web-page: add FTP command query
https://code.google.com/p/security-onion/issues/detail?id=506

Issue 507: securityonion-web-page: add queries for BRO_INTEL
https://code.google.com/p/security-onion/issues/detail?id=507

Screenshots

FTP: Top Commands - group all FTP logs by FTP command

Drilling into FTP STOR command to look for data exfil

Intel: Top SRC IPs - group all Intel logs by source IP address 

Intel: Top DST IPs - group all Intel logs by destination IP address 

Intel: Top DST Ports - group all Intel logs by destination port

Intel: Top Indicators - group all Intel logs by indicator

Intel: Top Indicator Types - group all Intel logs by indicator type

Intel: Top Sources - group all Intel logs by source

Updating
The new package is now available in our stable repo.  Please see the following page for full update instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Training
Want to learn more about Security Onion?  Sign up for the new expanded 2-day class in Houston TX!  For full details and to register, please see:
https://securityonion20140508.eventbrite.com

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list:
http://groups.google.com/group/security-onion

We also need help testing new packages:
http://groups.google.com/group/security-onion-testing

Thanks!