Looking at Asprox again

I started up the asprox bot again to poke around at it. Ever since they've changed the encryption, things have been much more challenging and time consuming. Nothing interesting so far but I did notice it has a very specific 13 minute wait before hitting up the c2 server for checkins.

Another great network tool - tcpflow

If you are a frequent packet sniffer like I am, you are usually always looking for better ways to filter through all the crap. Recently I needed to save packet information to files for processing. Using something like wireshark or tcpdump is the norm. Then when you want to reassemble a transaction you have to follow the flow in Wireshark.

The linux command line tool tcpflow does this for you though. When it is initialized with something like this "tcpflow -i eth2 -s host 192.168.1.3", it will look at all transactions involving 192.168.1.3. When a transaction is completed, it will write the full transaction details to a single file. In the case of monitoring an infected machine or looking at file transfers, tcpflow would save the entire file transferred in to a single file. Yay convenience.

Here's a man page for it. Check it out.