This capture was done by intercepting all the packets going to ports 80,8080,8000,443,8443 and redirecting them to a mitmproxy.
RobotHash
- Infected host: 192.168.1.113
- Default GW: 192.168.1.2
started win3
infected
power off
The malware connects to servers using the port 443/TCP, but the traffic is not TLS or SSL. We know it because the mitm proxy was complaining that the handshake was broken and when we checked, the traffic does not have the structure of SSL or TLS.