Hello, guys, and welcome to the last video on this chapter
in this video, we are going to see how Wireshark can help us identify
if the host in the network is infected with some kind of a Bot.
So I started Wireshark and I loaded
a captured file for this case that we are going to have a
look into if anything suspicious is happening.
This captured file, you can also find it in the Wireshark capture shambles online.
And you can go ahead and download and do your own investigation and practice
and see if you can find the same things as me.
And also that will help you gain experience and utilize that in a project.
So the first thing that I always
search, as you can see, you already have it like in front of you,
is that if anything like SIEM package going out
from a specific host to other hosts in specific ports and so on.
So if you have a big.
But I think that you captured and you saved for this violin, you don't
want to go through each and every line you can go ahead and use the.
TCP display a builder and immediately all the TCP.
Traffic will be presented to you in front
of you, so as you can see from this file, we have a lot of flexing package going to
specific ports from the specific source, IP, as you can see, this dot.
The standard dot 129, dot to 11 dot 13
going to virus, actually destination IPS been specific port, as you
can see, and then if you go down, you scroll down.
That is also from the same destination.
The same IP, Source, IP and the different port and so on and so
forth, so you can see that there is a specific host.
While doing that, you can also see that the source IP and destination IPs and
in the same network, but in different subnets and
you can see there's definitely something suspicious coming out from this host
that actually affecting other host internet port as well.
So usually after you've been through this
investigation to check if something abnormal happening in your network,
you can go ahead and take for any kind of like DNS queries that may be happening.
And you will be, of course, alarmed if you
find this host IP and in your DNS filtered results, let's go ahead and type DNS.
.
And see what's going on, so we have responses bits results here,
you can see straight away the same IP the source IP that was generating this
SIEM package to other host in the network, then
the standard 129 dot to 11, dot 13, but then DNS Query
that we can see that there is a Domain here, bbjj.houseshot.com.
And then it receives a response.
And then it immediately sent another DNS Query to another Domain and then received
another response and then again to another Domain and so on and so forth,
um, you can another thing that you can go through, it's another line.
What do you have to actually pay attention is the dns query responses.
In this case is
so if you highlight the DNS query response and you go down here to domain name system
and expand that, you will get like valuable information.
You can see that you have here in the flags section, you have the
questions, the answer authority under resource records
authority, the resource records and additional resource records.
So this number here is a little bit alarming.
Usually when you have like a question one,
the answers should be around three, four, maybe maximal five at some point.
In some cases,
the authority addresses to and additional other resource records
is three, so this this is very alarming and you can go ahead and
see more information on the answers if you go here to answers and expand this.
So as you can see, there is all of the IP addresses on the answers.
And this is this should be making you very
nervous when you see something like that, like more than three four IP addresses.
And the canonical name here this wpg ypgw.walloan.com
and so on, you can go ahead and take the other DNS query response from this one.
You can see this is also like 11 answers.
It is very alarming.
And you can also
take all this IP addresses and so on, and since we have
figure out, the first thing that is there is definitely some traffic that is
not normal and we don't want it to be there.
Let us find out where this is generated to and what is this whole thing.
So after a Google search, we have found
some information that this is definitely a Bot.
So you can see that.
Tomorrow, it's a Trojan, it's a
Aliases is MocBot, it's an IRCBot, and it can spread using a certain type of
vulnerability and we can do plug and play service.
So if you go down in this page.
We can see that there is a lot more
technical details explaining how it delivers itself and install itself to the
system, what is the functionality and so on.
So these both file is PE executable, which seven thousand eight hundred forty
six bytes long, and it's packed with a new file compression.
So when the Bot file started, it copies
itself as an exact file to the With the system folder and then.
Some sort of service with some
specific attributes, as you can see here, they are listed,
so when the Bot is active, it connects to IoT Server and turns a
particular channel and acts as a Bot there.
But before IRC server they are used by the Bot is.
There you go.
You see both of these Domain that we found in our.
Wireshark.
So you can see that this is the bbjj.
Househost.com and this ypgw.wallloan.com.
So further more you can see that the bot joins
password-protected IRC channel where the hacker can send commands
to the bots in order to control infected machines.
So there is several task can be performed.
And you can also see that these bots for other IP addresses and Exploit
several other vulnerabilities of other folks in the same network
so it can expand the Botnet network of the malicious.
Agent.
So Backdoor Wireshark traffic analysis.
One more thing you can use straight away.
Instead of filtering
the results with DNS, you can also you can also do that first, take the necessary set
as a second step first, and then if you would like to see more.
And you can go ahead to highlight.
And one of the query responses you have in your DNS
display, filter results, you can go to answer to resource records and you can do
right click preparer's filter and select it
so immediately you can see in the display filter.
It appeared the dns.count.answers == 12 sign straight away,
so you can use that as a display filter if you would like to search, let's say, if
you have a graphic capture that you would like to search if you have
answers more than four, let's say, or do you get searched by more than five, which
is like the ultimate limit that you can search for, for suspicious
DNS query responses so you can go ahead and delete the 12 and equally sign, you
can keep the dns.count.a nswers and then space.
You can use the greater sign and then you can type 4
before you can hit afterwards enter and this will filter out.
And this will be, after all the results
that they have, dns query response with answers more than four.
So there you go. You have it.
So this is indeed the two results that we expected to be presented in front of us.
With us is more than four, so you can
speed up the procedure by using this display filter.
So that was all for this video and we
reached at this point, the end of this course, I hope you have learned valuable
information that will help you in your current career or your future one.
Thank you for taking part with me in this
journey to understand how unethical Hacker can utilize Wireshark and its functions.
So until next time, keep hiking for a good cause.