Ask Your Question

How detecting a botnet from a pcap file ?

asked 2020-06-24 15:14:37 +0000

salwa1215 gravatar image

I want to know if there is a way to detect a botnet like Ares botnet from a pcap file please ?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2020-06-24 15:46:39 +0000

Chuckc gravatar image

Article with link to the original report.

the Ares infection preys on the poorly secured configurations many set-top boxes use with the ADB debugging interface in Android. In many of the boxes, TCP port 5555 has been opened for both ADB and remote management commands, making it an easy target to any attacker able to scan the open internet.

Do you have a baseline for "normal" in your network? Does it include adb traffic?
The attack uses android adb.
A display filter of tcp.port==5555 or tcp.port in {5555..5585} would be a good start.

edit flag offensive delete link more



If only folks would implement RFC 3514 properly then life would be easy.

grahamb gravatar imagegrahamb ( 2020-06-24 16:06:44 +0000 )edit

I dont apply for Android. I used it for linux machine. I tested tcp.port==5555 or tcp.port in {5555..5585} but they are not used

salwa1215 gravatar imagesalwa1215 ( 2020-06-25 10:26:44 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2020-06-24 15:14:37 +0000

Seen: 1,709 times

Last updated: Jun 25 '20