JA3S

Cookie parameters from GzipLoader request in NetworkMiner 2.8.1

Forensic Timeline of an IcedID Infection

| | BackConnect, Cobalt Strike, CobaltStrike, ec74a5c51106f0419184d0dd08fb05bc, GzipLoader, IcedID, JA3S, Keyhole, Keylog, NetworkMiner, VNC, Windows Sandbox
The BackConnect and VNC parsers that were added to NetworkMiner 2.8.1 provide a unique possibility to trace the steps of an attacker with help of captured network traffic from a hacked computer ...
NETRESEC Network Security Blog
CapLoader 1.9.4

CapLoader 1.9.4 Released

| | CapLoader, JA3, JA3S, pcap, Protocol Detection, Protocol Identification, SPID, TLS, VXLAN
A new version of our advanced PCAP filtering tool CapLoader was released today. The new CapLoader 1.9.4 release includes features like JA3 hash extraction from TLS traffic and a fantastic thing called ...
NETRESEC Network Security Blog
Screenshot of original infection email from Unit 42

Emotet C2 and Spam Traffic Video

| | 37cdab6ff1bd1c195bacb776c5213bf2, 51c64c77e60f3980eea90869b68c58a8, C2, Command And Control, ec74a5c51106f0419184d0dd08fb05bc, Emotet, fd4bc6cea4877646ccd62f0792ec0b62, JA3, JA3S, pcap, smtp, SMTPS, Spam, spambot, STARTTLS, video, videotutorial, Windows Sandbox
This video covers a life cycle of an Emotet infection, including initial infection, command-and-control traffic, and spambot activity sending emails with malicious spreadsheet attachments to infect new victims. The video cannot be ...
NETRESEC Network Security Blog
NetworkMiner 2.7 Logo

NetworkMiner 2.7 Released

| | ANY.RUN, DNS SRV, DNS TXT, JA3, JA3S, LPD, LPR, MalwareBazaar, NetworkMiner, OSINT, pcap, PCL, PostScript, RFC1179, SMB2, ThreatFox, URLhaus
We are happy to announce the release of NetworkMiner 2.7 today! The new version extracts documents from print traffic and pulls out even more files and parameters from HTTP as well as ...
NETRESEC Network Security Blog