[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/wireshark-tutorial-emotet-infection/) * [Japanese](https://unit42.paloaltonetworks.com/ja/wireshark-tutorial-emotet-infection/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Learning Hub](https://unit42.paloaltonetworks.com/category/learning-hub/ "Learning Hub") * [Cybersecurity Tutorials](https://unit42.paloaltonetworks.com/category/cybersecurity-tutorials/ "Cybersecurity Tutorials") [Cybersecurity Tutorials](https://unit42.paloaltonetworks.com/category/cybersecurity-tutorials/) # Wireshark Tutorial: Examining Emotet Infection Traffic ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 15 min read * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Brad Duncan](https://unit42.paloaltonetworks.com/author/brad-duncan/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:January 19, 2021 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Cybersecurity Tutorials](https://unit42.paloaltonetworks.com/category/cybersecurity-tutorials/) * [Learning Hub](https://unit42.paloaltonetworks.com/category/learning-hub/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Emotet](https://unit42.paloaltonetworks.com/tag/emotet/) * [Wireshark Tutorial](https://unit42.paloaltonetworks.com/tag/wireshark-tutorial/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/wireshark-tutorial-emotet-infection/?pdf=download&lg=en&_wpnonce=40dbae5d0f "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/wireshark-tutorial-emotet-infection/?pdf=print&lg=en&_wpnonce=40dbae5d0f "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Wireshark%20Tutorial:%20Examining%20Emotet%20Infection%20Traffic&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fwireshark-tutorial-emotet-infection%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fwireshark-tutorial-emotet-infection%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fwireshark-tutorial-emotet-infection%2F&title=Wireshark%20Tutorial:%20Examining%20Emotet%20Infection%20Traffic "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fwireshark-tutorial-emotet-infection%2F&text=Wireshark%20Tutorial:%20Examining%20Emotet%20Infection%20Traffic "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fwireshark-tutorial-emotet-infection%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Wireshark%20Tutorial:%20Examining%20Emotet%20Infection%20Traffic%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fwireshark-tutorial-emotet-infection%2F "Share in Mastodon") ## Executive Summary This tutorial is designed for security professionals who investigate suspicious network activity and review packet captures (pcaps). Familiarity with [Wireshark](https://www.wireshark.org/) is necessary to understand this tutorial, which focuses on Wireshark version 3.x. [Emotet](https://malpedia.caad.fkie.fraunhofer.de/details/win.emotet) is an information-stealer [first reported in 2014](https://blog.trendmicro.com/trendlabs-security-intelligence/new-banking-malware-uses-network-sniffing-for-data-theft/) as banking malware. It has since evolved with additional functions such as a dropper, distributing other malware families like [Gootkit](https://isc.sans.edu/forums/diary/Emotet+infections+and+followup+malware/24532/), [IcedID](https://www.malware-traffic-analysis.net/2019/01/18/index.html), [Qakbot](https://www.malware-traffic-analysis.net/2020/08/10/index.html) and [Trickbot](https://twitter.com/Unit42_Intel/status/1320847745155059712). Today's Wireshark tutorial reviews recent Emotet activity and provides some helpful tips on identifying this malware based on traffic analysis. Note: These instructions assume you have customized Wireshark as described in [our previous Wireshark tutorial about customizing the column display](https://unit42.paloaltonetworks.com/unit42-customizing-wireshark-changing-column-display/). You will need to access a GitHub repository with ZIP archives containing [the pcaps used for this tutorial](https://github.com/pan-unit42/wireshark-tutorial-Emotet-traffic). **Warning:** Some of the pcaps used for this tutorial contain Windows-based malware. There is a risk of infection if using a Windows computer. If possible, we recommend you review these pcaps in a non-Windows environment like BSD, Linux or macOS. ## Chain of Events for an Emotet Infection To understand network traffic caused by Emotet, you must first understand the chain of events leading to an infection. Emotet is commonly distributed through malicious spam (malspam) emails. The critical step in an Emotet infection chain is a Microsoft Word document with macros designed to infect a vulnerable Windows host. ![This Word document shown was used to cause an Emotet infection in January 2021. Note the message in the screenshot: This document is protected. Previewing is not available for protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-30.jpeg) Figure 1. Screenshot of a Word document used to cause an Emotet infection in January 2021. Malspam spreading Emotet uses different techniques to distribute these Word documents. The malspam may contain an attached Microsoft Word document or have an attached ZIP archive containing the Word document. In recent months, we have seen several examples where these ZIP archives are password-protected. Some emails distributing Emotet do not have any attachments. Instead, they contain a link to download the Word document. In previous years, malspam pushing Emotet has also used PDF attachments with embedded links to deliver these Emotet Word documents. Figure 2 illustrates these four distribution techniques. ![Distribution paths for Emotet Word document: 1) malspam with attachment to Word doc; 2) malspam with attachment to ZIP archive to Word doc; 3) malspam with link to web traffic to download Word doc to Word doc; 4) malspam with attachment to PDF file to web traffic to download Word doc to Word doc](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-31.jpeg) Figure 2. Various distribution paths for an Emotet Word document. After the Word document is delivered, if a victim opens the document and enables macros on a vulnerable Windows host, the host is infected with Emotet. From a traffic perspective, we see the following steps from an Emotet Word document to an Emotet infection: * Web traffic to retrieve the initial binary. * Encoded/encrypted command and control (C2) traffic over HTTP. * Additional infection traffic if Emotet drops follow-up malware. * SMTP traffic if Emotet uses the infected host as a spambot. Figure 3 shows a flowchart of network activity we might find during an Emotet infection. ![Flowchart for an Emotet infection: Word doc to enable macros to web traffic for initial binary to initial binary. From there, encoded C2 traffic over HTTP, which is a hub in the flowchart that can lead to follow-up malware, spambot activity, data exfiltration and updating the binary.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-32.jpeg) Figure 3. Flowchart for an Emotet infection. Since Dec. 21, 2020, the initial binary for Emotet has been a Windows DLL file. Previously, this binary had been a Windows EXE file. Emotet C2 traffic consists of encoded or otherwise encrypted data sent over HTTP. This C2 activity can use either standard or non-standard TCP ports associated with HTTP traffic. This C2 activity also consists of data exfiltration and traffic to update the initial Emotet binary. Since Emotet is also a malware dropper, the victim may become infected with other malware. Analysts should search for traffic from other malware when investigating traffic from an Emotet-infected host. Finally, an Emotet-infected host may also become a spambot generating large amounts of traffic over TCP ports associated with SMTP like TCP ports 25, 465 and 587. ## Pcaps of Emotet Infection Activity Five password-protected ZIP archives containing pcaps of recent Emotet infection traffic are available at [this GitHub repository](https://github.com/pan-unit42/wireshark-tutorial-Emotet-traffic). Once on the GitHub page, click on each of the ZIP archive entries and download them, as shown in Figures 4 and 5. ![The screenshot shows how to download ZIP archives used for this Wireshark tutorial from the GitHub repository.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-33.jpeg) Figure 4. GitHub repository with links to ZIP archives used for this tutorial. ![The screenshot shows where to click to download one of the ZIP archives used for this Wireshark Tutorial on analyzing Emotet infection traffic.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-34.jpeg) Figure 5. Downloading one of the ZIP archives for this tutorial. Use ***infected*** as the password to extract pcaps from these ZIP archives. This should give you the following five pcap files: * Example-1-2021-01-06-Emotet-infection.pcap * Example-2-2021-01-05-Emotet-with-spambot-traffic-part-1.pcap * Example-3-2021-01-05-Emotet-with-spambot-traffic-part-2.pcap * Example-4-2021-01-05-Emotet-infection-with-Trickbot.pcap * Example-5-2020-08-18-Emotet-infection-with-Qakbot.pcap ## Example 1: Emotet Infection Traffic Open ***Example-1-2021-01-06-Emotet-infection.pcap*** in Wireshark and use a basic web filter as described in our previous[tutorial about Wireshark filters](https://unit42.paloaltonetworks.com/using-wireshark-display-filter-expressions/). The basic filter for Wireshark 3.x is: (http.request or tls.handshake.type eq 1) and !(ssdp) If you've set up Wireshark according to our initial [tutorial about customizing Wireshark displays](https://unit42.paloaltonetworks.com/unit42-customizing-wireshark-changing-column-display/), your display should look similar to Figure 6. ![Figure 6. Our first pcap in this tutorial filtered in Wireshark.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-35.jpeg) Figure 6. Our first pcap in this tutorial filtered in Wireshark. As shown in Figure 6, the first five HTTP GET requests represent four URLs used to retrieve the initial Emotet DLL. The traffic is: * hangarlastik\[.\]com GET /cgi-bin/Ui4n/ * hangarlastik\[.\]com GET /cgi-sys/suspendedpage.cgi * padreescapes\[.\]com GET /blog/0I/ * sarture\[.\]com GET /wp-includes/JD8/ * seo.udaipurkart\[.\]com GET /rx-5700-6hnr7/Sgms/ The first two URLs indicate hangarlastik\[.\]com no longer had the Emotet DLL file it had been hosting. Follow TCP streams for each of these requests to see replies to each of the HTTP GET requests. An easier way to see the HTTP responses is to update your Wireshark basic web filter to include HTTP responses: (http.request **or http.response** or tls.handshake.type eq 1) and !(ssdp) This will show HTTP responses in the ***Info*** column, as illustrated in Figure 7. ![Figure 7. Adding HTTP responses to the Wireshark display filter.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-36.jpeg) Figure 7. Adding HTTP responses to the Wireshark display filter. Now we have a clearer picture of what happened when the Word macro tried to retrieve an Emotet DLL: * hangarlastik\[.\]com GET /cgi-bin/Ui4n/ * HTTP/1.1 302 Found * hangarlastik\[.\]com GET /cgi-sys/suspendedpage.cgi * HTTP/1.1 200 OK * padreescapes\[.\]com GET /blog/0I/ * HTTP/1.1 401 Unauthorized * sarture\[.\]com GET /wp-includes/JD8/ * HTTP/1.1 403 Forbidden * seo.udaipurkart\[.\]com GET /rx-5700-6hnr7/Sgms/ The only 200 OK was a reply for a suspended page notification from hangarlastik\[.\]com. The HTTP GET request to seo.udaipurkart\[.\]com does not show a response, so follow the TCP stream for this request, as shown in Figure 8. ![Figure 8. Following TCP stream for the HTTP request to seo.udaipurkart\[.\]com.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-37.jpeg) Figure 8. Following TCP stream for the HTTP request to seo.udaipurkart\[.\]com. The TCP stream shows indicators that seo.udaipurkart\[.\]com returned a Windows DLL file, as shown in Figure 9. ![Figure 9. Indicators of a DLL file returned from seo.udaipurkart\[.\]com.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-38.jpeg) Figure 9. Indicators of a DLL file returned from seo.udaipurkart\[.\]com. Export this DLL from the pcap by using the menu path: ***File --\> Export Objects --\> HTTP,*** as shown in Figure 10. As always, we recommend you do not export this file in a Windows environment, since the DLL is Windows-based malware. ![Figure 10. Exporting the Emotet DLL from our first pcap.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-39.jpeg) Figure 10. Exporting the Emotet DLL from our first pcap. The SHA256 hash for this extracted DLL is: 8e37a82ff94c03a5be3f9dd76b9dfc335a0f70efc0d8fd3dca9ca34dd287de1b Emotet C2 traffic is encoded data sent using HTTP POST requests. You can easily find these requests in Wireshark using the following filter: http.request.method eq POST The results are shown in Figure 11. ![Figure 11. Filtering for HTTP POST requests in our first pcap.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-40.jpeg) Figure 11. Filtering for HTTP POST requests in our first pcap. In our first pcap, Emotet C2 traffic consists of HTTP POST requests to: * 5\.2.136\[.\]90 over TCP port 80 * 167\.71.4\[.\]0 over TCP port 8080 Emotet generates two types of HTTP POST requests for its C2 traffic. The first type of POST request ends with HTTP/1.1. The second type of POST request ends with HTTP/1.1 (application/x-www-form-urlencoded). Follow the TCP stream for the initial HTTP request to 5.2.136\[.\]90 at 16:42:34 UTC to see an example of the first type of C2 POST request, as shown in Figure 12. ![Figure 12. The first type of HTTP POST request for Emotet C2 traffic.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-41.jpeg) Figure 12. The first type of HTTP POST request for Emotet C2 traffic. Figure 12 shows this POST request sends approximately 6 KB of form-data that appears to be an encoded or encrypted binary. Scroll down to the HTTP response to see encoded data returned from the server. Figure 13 shows the start of this encoded data. ![Figure 13. Encoded data returned from the server in response to the HTTP POST request.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-42.jpeg) Figure 13. Encoded data returned from the server in response to the HTTP POST request. This type of encoded or encrypted data is how Emotet botnet servers exchange data with an infected Windows host. This is also the channel Emotet uses to update the Emotet DLL and drop follow-up malware. The second type of HTTP POST request for Emotet C2 traffic looks noticeably different than the first type. Use the following filter in Wireshark to easily find the second type of HTTP POST request: urlencoded-form This should return two HTTP POST requests to 167.71.4\[.\]0 over TCP port 8080, as shown in Figure 14. ![Figure 14. Filtering for the second type of HTTP POST request in Emotet C2 traffic.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-43.jpeg) Figure 14. Filtering for the second type of HTTP POST request in Emotet C2 traffic. Follow the TCP stream for the first of these two HTTP POST requests at 16:58:43 UTC. Review the traffic. The results are shown in Figure 15. ![Figure 15. TCP stream for the second type of HTTP POST request in Emotet C2 traffic.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-44.jpeg) Figure 15. TCP stream for the second type of HTTP POST request in Emotet C2 traffic. As shown in Figure 15, some of the data sent in the POST request is encoded as a base64 string with some URL encoding. For example, %2B is used for a + symbol, %2F represents / and %3D is used for =. Data sent in response from the server is encoded or otherwise encrypted. Our first pcap has no follow-up malware or other significant activity. The only other activity is repeated connection attempts to 46.101.230\[.\]194 over TCP port 443. You can easily spot this activity by filtering on TCP SYN segments that are retransmissions. Use the following Wireshark filter: tcp.analysis.retransmission and tcp.flags eq 0x0002 The results are shown in Figure 16. ![Figure 16. Filtering on retransmissions of TCP SYN segments in Wireshark.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-45.jpeg) Figure 16. Filtering on retransmissions of TCP SYN segments in Wireshark. An Internet search on 46.101.230\[.\]194 should reveal this IP address has been used for Emotet C2 activity. The remaining traffic in the pcap is system traffic generated by a Microsoft Windows 10 host. In our next pcap, we examine an Emotet infection with spambot activity. ## Example 2: Emotet With Spambot Traffic, Part 1 Open ***Example-2-2021-01-05-Emotet-with-spambot-traffic-part-1.pcap*** in Wireshark and use a basic web filter, as shown in Figure 17. ![Figure 17. Traffic from the second pcap filtered in Wireshark using our basic web filter.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-46.jpeg) Figure 17. Traffic from the second pcap filtered in Wireshark using our basic web filter. Similar to our first example, we receive some HTTP GET requests before Emotet C2 traffic. These GET requests are attempts to download the initial Emotet DLL over web traffic. The first frame in the column display shows HTTPS traffic to obob\[.\]tv, which was probably a web request for the initial Emotet DLL, because [this domain was reported as hosting an Emotet binary on Jan. 5, 2021](https://urlhaus.abuse.ch/url/949290/), the same date as the traffic in our pcap. Follow the TCP stream for the HTTP GET request to miprimercamino\[.\]com to confirm it returned an Emotet DLL. You should see indicators similar to Figure 9 from our first pcap. We can export the Emotet DLL returned from miprimercamino\[.\]com, as shown in Figure 18. ![Figure 18. Exporting the Emotet DLL from the pcap.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-47.jpeg) Figure 18. Exporting the Emotet DLL from the pcap. The SHA256 hash for the extracted DLL from our second pcap is: 963b00584d8d63ea84585f7457e6ddcac9eda54428a432f388a1ffee21137316 Again, we find two types of HTTP POST requests for Emotet C2 traffic. To filter for each type of Emotet C2 HTTP POST request, use the following Wireshark filters: * First type: http.request method eq POST and !(urlencoded-form) * Second type: urlencoded-form Follow TCP streams for the HTTP POST requests returned by these filters and confirm they follow the same patterns seen in our first pcap. After reviewing some examples of Emotet C2 traffic from this pcap, let's move on to the spambot activity. In this example, our infected host was turned into a spambot, so we also have SMTP traffic. The spambot SMTP traffic is encrypted, but we can easily find it by using our basic web filter and scrolling down the column display. At 20:06:20 UTC, the pcap starts showing SSL/TLS traffic to TCP ports associated with the SMTP email protocol, like TCP ports 25, 465 and 587, as shown in Figure 19. ![Figure 19. Using the basic web filter and scrolling through the column display to find spambot traffic.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-48.jpeg) Figure 19. Using the basic web filter and scrolling through the column display to find spambot traffic. We can filter on smtp to find some of the SMTP commands before encrypted SMTP tunnels are established. Figure 20 shows the results. ![Figure 20. Filtering for SMTP traffic in our second pcap.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-49.jpeg) Figure 20. Filtering for SMTP traffic in our second pcap. We can sometimes find unencrypted SMTP from spambot traffic generated by an Emotet-infected Windows host. Unencrypted SMTP will reveal its message content, but the volume of encrypted SMTP from a spambot host is far greater than the volume of unencrypted SMTP. Therefore, most of the spambot messages from an Emotet-infected host are hidden within the encrypted traffic. In this example, you should only see encrypted SMTP traffic. But our next example is later from this same infection, when we finally saw some unencrypted SMTP. ## Example 3: Emotet With Spambot Traffic, Part 2 Open ***Example-3-2021-01-05-Emotet-with-spambot-traffic-part-2.pcap*** in Wireshark and use a basic web filter, as shown in Figure 21. ![Figure 21. Traffic from the third pcap filtered in Wireshark using our basic web filter.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-50.jpeg) Figure 21. Traffic from the third pcap filtered in Wireshark using our basic web filter. In this pcap, we still see HTTP POST requests for Emotet C2 traffic, at least twice each minute. We can also find encrypted spambot activity similar to our previous pcap. Spambot activity frequently generates a large amount of traffic. This pcap consists of 4 minutes and 42 seconds of spambot activity from the infected Windows host, and it's over 21 MB of traffic. We can quickly identify any unencrypted SMTP traffic by using the following Wireshark filter: smtp.data.fragment Figure 22 shows the results of this filter for our third pcap. The filter reveals five examples of Emotet malspam generated by the infected Windows host. ![Figure 22. Filtering for indicators of unencrypted SMTP from spambot traffic.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-51.jpeg) Figure 22. Filtering for indicators of unencrypted SMTP from spambot traffic. Follow the TCP stream for the last email from: "Gladisbel Miranda at 20:19:54 UTC. Examine what these messages look like, as shown in Figure 23. ![Figure 23. TCP stream for an example of Emotet malspam from our third pcap.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-52.jpeg) Figure 23. TCP stream for an example of Emotet malspam from our third pcap. We can export these five items of Emotet malspam by using the menu path ***File --\> Export Objects --\> IMF,*** as shown in Figure 24. ![Figure 24. Exporting Emotet malspam from our third pcap.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-53.jpeg) Figure 24. Exporting Emotet malspam from our third pcap. Export these emails and examine them. Ideally, we recommend doing this in a non-Windows environment. [Thunderbird](https://www.thunderbird.net/en-US/) is a free email client you can use to see how a potential victim might view these emails. As mentioned earlier, Emotet is also a malware downloader. Perhaps the most common malware distributed through Emotet is Trickbot. ## Example 4: Emotet Infection with Trickbot Open ***Example-4-2021-01-05-Emotet-infection-with-Trickbot.pcap*** in Wireshark and use a basic web filter, as shown in Figure 25. ![Figure 25. Traffic from the fourth pcap filtered in Wireshark using our basic web filter.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-54.jpeg) Figure 25. Traffic from the fourth pcap filtered in Wireshark using our basic web filter. This pcap does not have an HTTP GET request for an initial Emotet DLL. However, the first frame in our column display shows HTTPS traffic to fathekarim\[.\]com. This was probably a web request for the Emotet DLL, because [this domain was reported as hosting an Emotet binary on Jan. 5, 2021](https://urlhaus.abuse.ch/url/949449/), the same date as the traffic in our pcap. You should find the same two types of HTTP POST requests associated with Emotet C2, as described in our previous two pcaps. This pcap also contains indicators of a Trickbot infection. Use your basic web filter and scroll down to find Trickbot traffic, as shown in Figure 26. ![Figure 26. Scrolling down the column display to find Trickbot indicators in our fourth pcap using a basic web filter.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-55.jpeg) Figure 26. Scrolling down the column display to find Trickbot indicators in our fourth pcap using a basic web filter. We've reviewed Trickbot in [our previous Wireshark tutorial on examining Trickbot infections](https://unit42.paloaltonetworks.com/wireshark-tutorial-examining-trickbot-infections/), but here is a quick refresher. The following are common indicators for Trickbot: * HTTPS traffic over TCP ports 447 or 449 without an associated domain or hostname. * HTTP POST requests over standard or non-standard TCP ports for HTTP traffic that end with /81/, /83/ or /90, which are associated with data exfiltration. * With Trickbot from Emotet infections, the above HTTP POST requests start with /mor followed by a number (only one or two digits seen so far). * HTTP GET requests for URLs that end in .png that return additional Trickbot binaries. We can easily find these indicators using the following Wireshark filters: * tls.handshake.type eq 1 and (tcp.port eq 447 or tcp.port eq 449) * (http.request.uri contains /81 or http.request.uri contains /83 or http.request.uri contains /90) and http.request.uri contains mor * http.request.uri contains .png Figures 27-29 show the results from each of the above filters. ![Figure 27.: Filtering for Trickbot HTTPS traffic over TCP port 447 or TCP port 449.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-56.jpeg) Figure 27.: Filtering for Trickbot HTTPS traffic over TCP port 447 or TCP port 449. ![Figure 28. Filtering for HTTP POST requests associated with Trickbot data exfiltration.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-57.jpeg) Figure 28. Filtering for HTTP POST requests associated with Trickbot data exfiltration. Follow TCP streams for each of the HTTP POST requests shown in Figure 28 to see if any password data was exfiltrated. The last HTTP POST request ending with /90 contains data about the infected Windows host and its environment. ![Figure 29. Filtering for HTTP GET requests ending in .png associated with additional Trickbot binaries.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-58.jpeg) Figure 29. Filtering for HTTP GET requests ending in .png associated with additional Trickbot binaries. Follow TCP streams for each of the HTTP POST requests shown in Figure 29 to see if any Windows binaries were returned. Doing so should reveal two Windows executable files. You can then export these binaries from the pcap using ***File --\> Export Objects --\> HTTP,*** as discussed in our previous examples. SHA256 hashes for these two Windows binaries (both EXE files) are: * 59e1711d6e4323da2dc22cdee30ba8876def991f6e476f29a0d3f983368ab461 for mingup.png * ed8dea5381a7f6c78108a04344dc73d5669690b7ecfe6e44b2c61687a2306785 for saved.png Trickbot is the most common malware distributed by Emotet, but it is not the only one. Qakbot is another type of malware frequently dropped on Emotet-infected Windows hosts. ## Example 5: Emotet Infection With Qakbot Open ***Example-5-2020-08-18-Emotet-infection-with-Qakbot.pcap*** in Wireshark and use a basic web filter, as shown in Figure 30. ![Figure 30. Traffic from the fifth pcap filtered in Wireshark using our basic web filter.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-59.jpeg) Figure 30. Traffic from the fifth pcap filtered in Wireshark using our basic web filter. In our fifth pcap, an Emotet Word document was retrieved from saketpranamam.mysquare\[.\]in at 21:23:50 UTC, which matches [a URL reported as hosting an Emotet Word document on the same date](https://urlhaus.abuse.ch/url/435882/). Export this Word document from the pcap using ***File --\> Export Objects --\> HTTP,*** as discussed in our previous examples. The SHA256 hash for this extracted Word document is: * c7f429dde8986a1b2fc51a9b3f4a78a92311677a01790682120ab603fd3c2fcb We also see HTTPS traffic to samaritantec\[.\]com at 21:24:40 UTC. [This domain was reported as hosting an Emotet binary on the same date](https://urlhaus.abuse.ch/url/436011/). As in our previous examples, you should find the same two types of HTTP POST requests associated with Emotet C2 traffic. Additionally, this pcap contains indicators of a Qakbot infection. Use your basic web filter and scroll down to find Qakbot traffic, as shown in Figure 31. ![Figure 31. Scrolling down the column display to find Qakbot indicators in our fifth pcap using a basic web filter.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-60.jpeg) Figure 31. Scrolling down the column display to find Qakbot indicators in our fifth pcap using a basic web filter. We've reviewed Qakbot in [our previous Wireshark tutorial on examining Qakbot infections](https://unit42.paloaltonetworks.com/tutorial-qakbot-infection/), but here is a quick refresher. The following are common indicators for Qakbot: * HTTPS traffic over standard and non-standard TCP ports for HTTPS. * Certificate data for Qakbot HTTPS traffic has unusual values for the issuer fields, and the certificate is not issued by an authority based in the United States. * TCP traffic over TCP port 65400. * Prior to late November 2020, Qakbot commonly generated HTTPS traffic to cdn.speedof\[.\]me. * Prior to late November 2020, Qakbot commonly generated HTTP GET requests to a.strandsglobal\[.\]com. We can easily find these indicators by using the following Wireshark filters: * tls.handshake.type eq 11 and !(x509sat.CountryName == US) * tcp.port eq 65400 * tls.handshake.extensions\_server\_name contains speedof * http.host contains strandsglobal Figures 32-35 show the results from each of the above filters. ![Figure 32. Filtering and searching for unusual certificate issuer data in HTTPS traffic generated by Qakbot.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-61.jpeg) Figure 32. Filtering and searching for unusual certificate issuer data in HTTPS traffic generated by Qakbot. In Figure 32, the results of our first filter show several frames in the column display for traffic from 71.80.66\[.\]107. Search through the frame details and find unusual certificate issuer data, as shown above. ![Figure 33. Filtering for Qakbot traffic over TCP port 65400.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-62.jpeg) Figure 33. Filtering for Qakbot traffic over TCP port 65400. In the above image, we find a single TCP stream of Qakbot traffic over TCP port 65400. This stream contains the public IP address and a botnet identification string for the Qakbot-infected Windows host. ![Figure 34. Filtering for traffic to cdn.speedof\[.\]me, which is not inherently malicious, but a connectivity check caused by Qakbot prior to late November 2020.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-63.jpeg) Figure 34. Filtering for traffic to cdn.speedof\[.\]me, which is not inherently malicious, but a connectivity check caused by Qakbot prior to late November 2020. ![Figure 35. Filtering for traffic to a.stransglobal\[.\]com, typically generated by Qakbot prior to late November 2020.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/01/word-image-64.jpeg) Figure 35. Filtering for traffic to a.stransglobal\[.\]com, typically generated by Qakbot prior to late November 2020. While Emotet has commonly dropped Trickbot and Qakbot, be aware that Emotet has also dropped other types of malware such as Gootkit and IcedID. ## Conclusion This tutorial reviewed how to identify Emotet activity from pcaps of its infection traffic. We reviewed five recent pcaps and found similarities in HTTP POST requests caused by Emotet C2 traffic. The patterns are fairly unique and can be used to identify an Emotet infection within your network. We also reviewed other post-infection activities associated with Emotet, such as spambot traffic and different families of malware dropped on an infected host. This knowledge can help security professionals better detect and catch an Emotet infection when reviewing suspicious network activity. For more help with Wireshark, see our previous tutorials: * [Changing Your Column Display](https://unit42.paloaltonetworks.com/unit42-customizing-wireshark-changing-column-display/) * [Display Filter Expressions](https://unit42.paloaltonetworks.com/using-wireshark-display-filter-expressions/) * [Identifying Hosts and Users](https://unit42.paloaltonetworks.com/using-wireshark-identifying-hosts-and-users/) * [Exporting Objects from a Pcap](https://unit42.paloaltonetworks.com/using-wireshark-exporting-objects-from-a-pcap/) * [Examining Trickbot Infections](https://unit42.paloaltonetworks.com/wireshark-tutorial-examining-trickbot-infections/) * [Examining Ursnif Infections](https://unit42.paloaltonetworks.com/wireshark-tutorial-examining-ursnif-infections/) * [Examining Qakbot Infections](https://unit42.paloaltonetworks.com/tutorial-qakbot-infection/) * [Decrypting HTTPS Traffic](https://unit42.paloaltonetworks.com/wireshark-tutorial-decrypting-https-traffic/) * [Examining Dridex Infection Traffic](https://unit42.paloaltonetworks.com/wireshark-tutorial-dridex-infection-traffic/) Back to top ### Tags * [Emotet](https://unit42.paloaltonetworks.com/tag/emotet/ "Emotet") * [Wireshark Tutorial](https://unit42.paloaltonetworks.com/tag/wireshark-tutorial/ "Wireshark Tutorial") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Open Source Tool Release: Gaining Novel AWS Access With EBS Direct APIs](https://unit42.paloaltonetworks.com/aws-ebs-direct-apis/ "Open Source Tool Release: Gaining Novel AWS Access With EBS Direct APIs") ### Table of Contents * ### Related Articles * [Spoofed GlobalProtect Used to Deliver Unique WikiLoader Variant](https://unit42.paloaltonetworks.com/global-protect-vpn-spoof-distributes-wikiloader/ "article - table of contents") * [Wireshark Tutorial: Exporting Objects From a Pcap](https://unit42.paloaltonetworks.com/using-wireshark-exporting-objects-from-a-pcap/ "article - table of contents") * [Wireshark Tutorial: Identifying Hosts and Users](https://unit42.paloaltonetworks.com/using-wireshark-identifying-hosts-and-users/ "article - table of contents") ## Related Cybersecurity Tutorials Resources ![A Black man in business attire using a tablet, with illuminated skyscrapers in the background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/01_Tutorial_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-podcast-player.svg)Learning Hub](https://unit42.paloaltonetworks.com/category/learning-hub/) March 1, 2024 [#### Wireshark Tutorial: Exporting Objects From a Pcap](https://unit42.paloaltonetworks.com/using-wireshark-exporting-objects-from-a-pcap/) * [Pcap](https://unit42.paloaltonetworks.com/tag/pcap/ "pcap") * [Wireshark](https://unit42.paloaltonetworks.com/tag/wireshark/ "Wireshark") * [Wireshark Tutorial](https://unit42.paloaltonetworks.com/tag/wireshark-tutorial/ "Wireshark Tutorial") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/using-wireshark-exporting-objects-from-a-pcap/ "Wireshark Tutorial: Exporting Objects From a Pcap") ![A man wearing headphones with a microphone is focused on multiple computer screens displaying graphs and data, indicating involvement in a professional tech or analytics environment.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/02_Tutorial_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-podcast-player.svg)Learning Hub](https://unit42.paloaltonetworks.com/category/learning-hub/) October 10, 2023 [#### Wireshark Tutorial: Identifying Hosts and Users](https://unit42.paloaltonetworks.com/using-wireshark-identifying-hosts-and-users/) * [Pcap](https://unit42.paloaltonetworks.com/tag/pcap/ "pcap") * [Wireshark](https://unit42.paloaltonetworks.com/tag/wireshark/ "Wireshark") * [Wireshark Tutorial](https://unit42.paloaltonetworks.com/tag/wireshark-tutorial/ "Wireshark Tutorial") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/using-wireshark-identifying-hosts-and-users/ "Wireshark Tutorial: Identifying Hosts and Users") ![An abstract illustration of a video that has been paused. It includes a red progress bar and a large white Play button.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/03_Tutorial_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-podcast-player.svg)Learning Hub](https://unit42.paloaltonetworks.com/category/learning-hub/) September 8, 2023 [#### Wireshark Tutorial: Display Filter Expressions](https://unit42.paloaltonetworks.com/using-wireshark-display-filter-expressions/) * [Pcap](https://unit42.paloaltonetworks.com/tag/pcap/ "pcap") * [Wireshark](https://unit42.paloaltonetworks.com/tag/wireshark/ "Wireshark") * [Wireshark Tutorial](https://unit42.paloaltonetworks.com/tag/wireshark-tutorial/ "Wireshark Tutorial") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/using-wireshark-display-filter-expressions/ "Wireshark Tutorial: Display Filter Expressions") ![A person focuses intently on a screen, with many lines of code on the monitor reflected in their glasses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/04_Tutorial_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-podcast-player.svg)Learning Hub](https://unit42.paloaltonetworks.com/category/learning-hub/) September 1, 2023 [#### RedLine Stealer: Answers to Unit 42 Wireshark Quiz](https://unit42.paloaltonetworks.com/wireshark-quiz-redline-stealer-answers/) * [Pcap](https://unit42.paloaltonetworks.com/tag/pcap/ "pcap") * [Wireshark Tutorial](https://unit42.paloaltonetworks.com/tag/wireshark-tutorial/ "Wireshark Tutorial") * [Redline infostealer](https://unit42.paloaltonetworks.com/tag/redline-infostealer/ "Redline infostealer") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/wireshark-quiz-redline-stealer-answers/ "RedLine Stealer: Answers to Unit 42 Wireshark Quiz") ![A man wearing headphones with a microphone is focused on multiple computer screens displaying graphs and data, indicating involvement in a professional tech or analytics environment.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/02_Tutorial_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-podcast-player.svg)Learning Hub](https://unit42.paloaltonetworks.com/category/learning-hub/) August 31, 2023 [#### Wireshark Tutorial: Changing Your Column Display](https://unit42.paloaltonetworks.com/unit42-customizing-wireshark-changing-column-display/) * [Pcap](https://unit42.paloaltonetworks.com/tag/pcap/ "pcap") * [Wireshark](https://unit42.paloaltonetworks.com/tag/wireshark/ "Wireshark") * [Wireshark Tutorial](https://unit42.paloaltonetworks.com/tag/wireshark-tutorial/ "Wireshark Tutorial") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/unit42-customizing-wireshark-changing-column-display/ "Wireshark Tutorial: Changing Your Column Display") ![Person wearing glasses and a hoodie, sitting in a dimly lit room, focused on a computer screen displaying complex data visualizations.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/06_Tutorial_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-podcast-player.svg)Learning Hub](https://unit42.paloaltonetworks.com/category/learning-hub/) August 18, 2023 [#### Crossing the Line: Unit 42 Wireshark Quiz for RedLine Stealer](https://unit42.paloaltonetworks.com/wireshark-quiz-redline-stealer/) * [Pcap](https://unit42.paloaltonetworks.com/tag/pcap/ "pcap") * [Redline infostealer](https://unit42.paloaltonetworks.com/tag/redline-infostealer/ "Redline infostealer") * [Wireshark Tutorial](https://unit42.paloaltonetworks.com/tag/wireshark-tutorial/ "Wireshark Tutorial") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/wireshark-quiz-redline-stealer/ "Crossing the Line: Unit 42 Wireshark Quiz for RedLine Stealer") ![A man wearing headphones with a microphone is focused on multiple computer screens displaying graphs and data, indicating involvement in a professional tech or analytics environment.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/02_Tutorial_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-podcast-player.svg)Learning Hub](https://unit42.paloaltonetworks.com/category/learning-hub/) May 30, 2023 [#### Cold as Ice: Answers to Unit 42 Wireshark Quiz for IcedID](https://unit42.paloaltonetworks.com/wireshark-quiz-icedid-answers/) * [Banking trojans](https://unit42.paloaltonetworks.com/tag/banking-trojans/ "banking trojans") * [Pcap](https://unit42.paloaltonetworks.com/tag/pcap/ "pcap") * [Wireshark](https://unit42.paloaltonetworks.com/tag/wireshark/ "Wireshark") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/wireshark-quiz-icedid-answers/ "Cold as Ice: Answers to Unit 42 Wireshark Quiz for IcedID") ![A woman is intently working on a computer in a modern office environment, surrounded by screens displaying dynamic digital data and stock market numbers, highlighting a focus on financial analysis.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/04_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-podcast-player.svg)Learning Hub](https://unit42.paloaltonetworks.com/category/learning-hub/) May 26, 2023 [#### Cold as Ice: Unit 42 Wireshark Quiz for IcedID](https://unit42.paloaltonetworks.com/wireshark-quiz-icedid/) * [Banking trojans](https://unit42.paloaltonetworks.com/tag/banking-trojans/ "banking trojans") * [Pcap](https://unit42.paloaltonetworks.com/tag/pcap/ "pcap") * [Wireshark](https://unit42.paloaltonetworks.com/tag/wireshark/ "Wireshark") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/wireshark-quiz-icedid/ "Cold as Ice: Unit 42 Wireshark Quiz for IcedID") ![Two people working in a modern office environment with one person concentrating on a computer screen displaying code while another person works in the background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/10_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/threat-actor-groups.svg)Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) May 15, 2023 [#### It's All in the Name: How Unit 42 Defines and Tracks Threat Adversaries](https://unit42.paloaltonetworks.com/from-activity-to-formal-naming/) * [Advanced Persistent Threat](https://unit42.paloaltonetworks.com/tag/advanced-persistent-threat/ "Advanced Persistent Threat") * [Nomenclature](https://unit42.paloaltonetworks.com/tag/nomenclature/ "nomenclature") * [Threat actors](https://unit42.paloaltonetworks.com/tag/threat-actors/ "threat actors") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/from-activity-to-formal-naming/ "It’s All in the Name: How Unit 42 Defines and Tracks Threat Adversaries") ![A Black man in business attire using a tablet, with illuminated skyscrapers in the background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/01_Tutorial_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-podcast-player.svg)Learning Hub](https://unit42.paloaltonetworks.com/category/learning-hub/) March 27, 2023 [#### Finding Gozi: Answers to Unit 42 Wireshark Quiz, March 2023](https://unit42.paloaltonetworks.com/march-wireshark-gozi-answers/) * [Gozi](https://unit42.paloaltonetworks.com/tag/gozi/ "Gozi") * [Pcap](https://unit42.paloaltonetworks.com/tag/pcap/ "pcap") * [Wireshark](https://unit42.paloaltonetworks.com/tag/wireshark/ "Wireshark") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/march-wireshark-gozi-answers/ "Finding Gozi: Answers to Unit 42 Wireshark Quiz, March 2023") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)