Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm looking at a packet capture of some traffic of a malware infected computer, where do I begin to look in trying to find the server program that the malware bot is trying to contact?

Wireshark screenshot

share|improve this question
add comment

1 Answer

For Windows, see this stack overflow question. TLDR summary: netstat -b lists all ports with the process names.

For Linux, netstat -tulpn gives you all the listening ports and netstat -tupn gives you all the outgoing ports and the associated PIDs. Run these commands as root. See video demo.

You just need to find out which port your malware communicates from. In Wireshark, this is the part where it says "adobeserver-2" or "adobeserver-1" in your packet capture. Wireshark displays these names instead of the actual port numbers to give users an idea of what the port is usually used for. To get the real port names, disable this feature as described on the Wireshark Ask site.

Alternatively, see How to determine what program send the packet recorded in Wireshark? where it is recommended to use a different program for this task.

share|improve this answer
    
Thanks, but I'm confused as to how that information will allow me to find which server program the bot is trying to contact. I noticed that it keeps on trying to GET a file called prxjdg.cgi would that be the same as the bot trying to contact a server program? –  Dex Jun 3 '13 at 7:35
    
Sorry, I thought you wanted to find out which program on your computer is sending these requests. As the bot tries to communicate on port 80 (indicated by the http target port in your Wireshark log) and sends HTTP requests, my best guess would be that it is trying to access an HTTP server. It is obviously trying to call a CGI script on that server. –  Chris Jun 3 '13 at 7:38
    
Oh! That makes more sense :) it first tries to contact w0rld.sesilmisler.com then tries to contact cgi14.plala.or.jp hpcgi1.nifty.com, age.ne.jp, kinchan.net, www2.dokidoki.ne.jp, yia.s22.xrea.com From this, where can I deduce most of the infected servers to be? (Are they in asia?) Why would they be located there?? –  Dex Jun 3 '13 at 8:16
    
Yes, they seem to be in Asia, more specifically Japan. You can most easily see this from the TLD: many of them end in .jp for Japan. I don't know why they are located there. Maybe the hacker is from Japan? Or maybe he has found a vulnerability in a software that mainly Japanese providers use? Maybe Japanese servers are hard to take down from the US? –  Chris Jun 3 '13 at 8:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.