OCTOPUS APT/2 Malware PCAP Download Traffic Analysis 88.198.204.196

2018-11-06 03:08:56.939686 IP 10.1.10.73.65480 > 10.1.10.100.55555: Flags [P.], seq 1:562, ack 1, win 2053, length 561 E..YJs@….} . I . d….*…….P…….GET /apt/DustSquad/OctopusDelphi.exe HTTP/1.1 Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml+xml, image/pjpeg, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */* Referer: http://10.1.10.100:55555/apt/DustSquad/ Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.2) Accept-Encoding: gzip, deflate Host: 10.1.10.100:55555 Connection: Keep-Alive 2018-11-06 03:08:56.939868 IP 10.1.10.100.55555 > 10.1.10.73.65480: Flags [.], ack 562, win 237, length 0 . I…….P……………………… 2018-11-06 03:09:11.604468 IP 148.251.185.168.80 > 10.1.10.73.65490: Flags [S.], seq 949224391, ack 3926170411, win 65535, options [mss 1460,nop,wscale 6,sackOK,eol], length […]

Private Internet Access VPN PCAP Traffic Analysis

2018-11-06 01:57:00.199169 IP 10.1.10.73.53791 > 193.37.253.121.8888: UDP, length 1 E…3…..4 . I.%.y..”.. ..a…………….. 2018-11-06 01:57:00.199180 IP 10.1.10.73.53800 > 172.98.79.203.8888: UDP, length 1 E…V……u . I.bO..(“.. ..a…………….. 2018-11-06 01:57:00.199183 IP 10.1.10.73.53793 > 162.216.46.73.8888: UDP, length 1 E…g……. . I…I.!”.. ..a…………….. 2018-11-06 01:57:00.199206 IP 10.1.10.73.53806 > 31.24.231.208.8888: UDP, length 1 E…w0…..m . I……”.. ..a…………….. 2018-11-06 01:57:00.199311 IP 10.1.10.73.53820 > 194.187.249.53.8888: UDP, length 1 E………X. . I…5.<“.. ..a…………….. 2018-11-06 01:57:00.199319 IP 10.1.10.73.53833 > 119.81.135.47.8888: UDP, length 1 E…H……. . IwQ./.I”.. ..a…………….. 2018-11-06 01:57:00.199343 IP 10.1.10.73.53838 > 138.128.180.74.8888: UDP, length 1 E….B…..y . I…J.N”.. V.a…………….. 2018-11-06 01:57:00.199350 IP 10.1.10.73.53813 > 103.231.91.35.8888: UDP, length 1 […]