Hands-On Network Forensics by Nipun Jaswal

Author:Nipun Jaswal [Nipun Jaswal]
Language: eng
Format: epub
Tags: COM043000 - COMPUTERS / Networking / General, COM053000 - COMPUTERS / Security / General, COM043050 - COMPUTERS / Security / Networking
Publisher: Packt Publishing
Published: 2019-03-30T11:26:05+00:00

We can see the first-byte word is 1200, which implies 00 12(18) being divided by 10, which means that we have the LokiBot version 1.8. Have a look at the following screenshot:

We can see that, in the next word (the next two bytes), we have hexadecimal values of 27, 28, and 2b, and, according to the information that we have read, this value defines the functionality of the packet and a value 27 implies Exfiltrate Application/Credential Data, 28 implies Get C2 commands, and 2b implies Exfiltrate Keylogger Data. This means that the LokiBot has done the following activities in order:

Exfiltrated an application's credential data twice

Made the new command, which was to exfiltrate key logger data

Sent keylogger data

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.