#WIRESHARK TUTORIAL REEVISION 3 WINDOWS#

HTTP GET and POST requests after Ursnif is persistent in the Windows registry.HTTP GET request for follow-up data, with the URL ending in.HTTP GET requests caused by the initial Ursnif binary.This category of Ursnif causes the following traffic: In this example, the Ursnif-infected host generates post-infection traffic to 8.208.24139 using various domain names ending with. The pcap for example 1 filtered in Wireshark. Open the pcap in Wireshark and filter on http.request as shown in Figure 3.įigure 3. Example 1 has been stripped of all traffic not directly related to the Ursnif infection. The chain of events behind this traffic was tweeted here. The first pcap for this tutorial, Ursnif-traffic-example-1.pcap, is available here. Example of Windows registry updates caused by samples of Ursnif, either with or without HTTPS post-infection traffic. For example, both types of Ursnif remain persistent on a Windows host by updating the Windows registry, such as the example shown in Figure 2.įigure 2. Malware samples from either of these categories create the same type of artifacts on an infected Windows host. Ursnif with HTTPS post-infection traffic.Ursnif without HTTPS post-infection traffic.This tutorial covers two categories of Ursnif infection traffic: Flowchart from one of the more common Ursnif distribution campaigns. We frequently find examples of Ursnif from malspam-based distribution campaigns, such as the example in Figure 1.įigure 1. In some cases, Ursnif is a follow-up infection caused by different malware families like Hancitor, as reported in this recent example.

Ursnif can be distributed through web-based infection chains and malicious spam (malspam). You should also have experience with Wireshark display filters as described in this additional tutorial. Note: This tutorial assumes you have a basic knowledge of Wireshark, and it uses a customized column display shown in this tutorial. Five examples of pcaps from Ursnif infections.Understanding these traffic patterns can be critical for security professionals when detecting and investigating Ursnif infections. This tutorial reviews packet captures (pcaps) of infection Ursnif traffic using Wireshark.

The Ursnif family of malware has been active for years, and current samples generate distinct traffic patterns. Ursnif is banking malware sometimes referred to as Gozi or IFSB.

Wireshark tutorial reevision 3