passionateIntern
commented
3 years ago I have tried combination of network generated on my host and also from known malicious PCAPs from malware traffic domain analysis dot net. Below are samples that I have used against.
[] Reading PCAP: /tmp/2013-12-19-Neutrino-EK-traffic.pcap [] Reading PCAP: /tmp/2018-08-24-Emotet-infection-traffic-with-Zeus-Panda-Banker.pcap [] Reading PCAP: /tmp/securitynik_00001_20210612101220.pcap [] Reading PCAP: /tmp/2019-11-12-traffic-analysis-exercise.pcap [] Reading PCAP: /tmp/securitynik_00001_20210612094536.pcap [] Reading PCAP: /tmp/2018-08-22-Emotet-infection-traffic-with-Zeus-Panda-Banker.pcap [] Reading PCAP: /tmp/securitynik_00001_20210612103559.pcap [] Reading PCAP: /tmp/2021-06-03-part-01-Qakbot-infection-with-Cobalt-Strike.pcap [] Reading PCAP: /tmp/2021-02-24-Qakbot-infection-with-spambot-traffic.pcap [] Reading PCAP: /tmp/2013-12-19-Neutrino-EK-traffic.pcap [] Reading PCAP: /tmp/2018-08-24-Emotet-infection-traffic-with-Zeus-Panda-Banker.pcap [] Reading PCAP: /tmp/securitynik_00001_20210612101220.pcap [] Reading PCAP: /tmp/2019-11-12-traffic-analysis-exercise.pcap [] Reading PCAP: /tmp/securitynik_00001_20210612094536.pcap [] Reading PCAP: /tmp/2018-08-22-Emotet-infection-traffic-with-Zeus-Panda-Banker.pcap [] Reading PCAP: /tmp/securitynik_00001_20210612103559.pcap [] Reading PCAP: /tmp/2021-06-03-part-01-Qakbot-infection-with-Cobalt-Strike.pcap [] Reading PCAP: /tmp/2021-02-24-Qakbot-infection-with-spambot-traffic.pcap [] Reading PCAP: /tmp/2013-12-19-Neutrino-EK-traffic.pcap [] Reading PCAP: /tmp/2018-08-24-Emotet-infection-traffic-with-Zeus-Panda-Banker.pcap [] Reading PCAP: /tmp/securitynik_00001_20210612101220.pcap [] Reading PCAP: /tmp/2019-11-12-traffic-analysis-exercise.pcap [] Reading PCAP: /tmp/securitynik_00001_20210612094536.pcap [] Reading PCAP: /tmp/2018-08-22-Emotet-infection-traffic-with-Zeus-Panda-Banker.pcap [] Reading PCAP: /tmp/securitynik_00001_20210612103559.pcap [] Reading PCAP: /tmp/2021-06-03-part-01-Qakbot-infection-with-Cobalt-Strike.pcap [*] Reading PCAP: /tmp/2021-02-24-Qakbot-infection-with-spambot-traffic.pcap
SecurityNik
Good afternoon, I have used pktintel against multiple known bad PCAPs from malware traffic analysis website and getting nothing malicious reported back to me. Also, within the ip_threat_intel, IPv4_session files I am not seeing any IPs downloaded. Here is my output when pktintel is ran. Could you please help me out.
] Checking your permission ... [] Running as Student123 with UID 0
[] Press CTRL+C to exit
[] Checking system platform ... Running on Linux. Good Start! [] Looking for backup directory 'pkt_backup' in the current folder Found backup directory [] Looking for config file ... Config file "./pktIntel.conf" found! [] Validating configuration file ... Main section found! IP section found! DOMAIN section found! URL section found! Monitored Ports section found ... Configuration file successfully validated! [] Verifying PCAP directory exists in MAIN section... PCAP directory reported as "/tmp/" Counting the number of files with .cap, .pcap or .pcapng extension Number of PCAPs found: 7 [] Preparing to perform system cleanup System cleanup completed! [] Beginning IP Threat Intelligence ... Downloading IP blocklist from: http://rules.emergingthreats.net/blockrules/compromised-ips.txt Successfully downloaded IP Threat Intelligence Downloading IP blocklist from: http://www.malwaredomainlist.com/hostslist/ip.txt Successfully downloaded IP Threat Intelligence Downloading IP blocklist from: http://myip.ms/files/blacklist/csf/latest_blacklist.txt Successfully downloaded IP Threat Intelligence Downloading IP blocklist from: http://www.spamhaus.org/drop/drop.txt Successfully downloaded IP Threat Intelligence Downloading IP blocklist from: https://www.spamhaus.org/drop/edrop.txt Looks like an issues was encountered. [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1123) Downloading IP blocklist from: http://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt Successfully downloaded IP Threat Intelligence Downloading IP blocklist from: http://talosintel.com/feeds/ip-filter.blf [] Removing duplicates from the downloaded IPs ... [] There are currently [4871] unique suspicious IPs downloaded! [*] Reading PCAP files ... Looking for TCP packets where ONLY the SYN flag is set. Also looking at UDP and ICMP packets By looking at the SYN flag, we are assuming the the 3-way handshake has started
[] Note I may take a while so work with me on this ... [] Comparing downloaded IPs with those in your PCAPs ... [] Lucky you! Nothing malicious being reported at this time!
[] Do try me again soon. I may have one or more interesting IP next time. I promise :-)
[] Closing the file ./ip_threat_intel_2021-06-12T09-55-53.txt [] Closing the file ./IPv4_session_2021-06-12T09-55-53.txt [] Closing the file ./IPv6_session_2021-06-12T09-55-53.txt [] Completed IP Threat Intelligence Lookup!