SHub Stealer PCAP Analysis: Finding C2 in Encrypted Traffic

The capture at a glance: 100% encrypted, 100/100 risk

One victim: 10.6.22.216, an Apple endpoint (MAC fc:fc:48:59:43:87) sitting behind a Cisco gateway at 10.6.22.1, which also serves as its only DNS resolver. Across 14,874 packets and 9.2 minutes, the host moves about 15 MB — and 97% of the external bytes terminate behind Cloudflare (AS13335). Not one HTTP request in the clear, not one readable payload. The adversary rented the same CDN your legitimate SaaS uses, and the entire attack hides inside it.

PcapAI’s dashboard calls the incident before any human look at the packets: Security Risk 100/100 (Action Required), Network Issues 60/100 (Degraded), posture CRITICAL, with spearphishing-TLD hits mapped to MITRE T1566.002 and four encrypted-channel detections mapped to T1573.001:

The report’s risk dashboard: a CRITICAL posture built entirely from encrypted traffic — TLD reputation, payload entropy, and flow correlation, no decryption involved.

Before walking the packets, here is the whole incident on one clock — every timestamp below comes straight from the capture:

t+0.0s    DNS  just4software.pro           the lure site (.pro, France)
t+36.1s   DNS  newcdn5.host06q.cfd         payload host on a .cfd domain
t+39.1s   TLS  generatee4026c.host06q.cfd  stealer backend, 3 sessions
t+43.1s   TLS  sharee4026c.host06q.cfd     stealer backend, 1 session
t+43.9s   DNS  beta6.fastlinkpulse.click   one-shot redirect hop
t+44.9s   DNS  lan31.swiftlinktap.click    one-shot redirect hop
t+45.8s   TLS  i2seperefiles.com           12 MB arrives (yes, arrives)
t+138.1s  DNS  8790tn5c190y51v7n2.com      new C2, paired with api.ipify.org
t+236.4s  TLS  8790tn5c190y51v7n2.com      2.2 MB leaves in 10.8 seconds
t+250s..  --   beacon every ~61 seconds    until the capture ends

t+0s — the lure is a software blog with a .pro domain

The very first frame of the capture is the story in miniature: a DNS query for just4software.pro. The name answers to 82.25.113.147, a French-hosted server 149 ms away, and over the next 73 seconds the Mac pulls about 104 kB from it over TLS 1.3. The supporting cast gives the page away as an ordinary-looking freeware blog: stats.wp.com and s.w.org (a WordPress build), even a l.facebook.com widget. Someone went looking for “free software” and found a page dressed for the part.

Packet #1 of the capture is already the lure: the just4software.pro lookup, then a TLS session whose SNI names the site in cleartext — encryption hides the page, not the destination.

This is the delivery stage — T1566.002, Phishing: Spearphishing Link in MITRE terms: a link that leads a human to a page that hands them malware. PcapAI scores the TLD itself: .pro rates a medium, and the .cfd domain about to appear rates critical — cheap, disposable TLDs are themselves an indicator, because legitimate software vendors almost never live there. For 36 seconds nothing else happens. That gap is a person: reading the page, finding the download button.

t+36s — the .cfd chain: encrypted C2 behind Cloudflare

At t+36.1s the Mac asks for newcdn5.host06q.cfd — and macOS asks twice, an A query and an HTTPS (type 65) query in the same microsecond, a detail that will matter later when the report grades DNS health. The first usable A record takes 3.1 seconds and several retries to arrive; the answer is a Cloudflare pair, 104.21.79.198 and 172.67.147.208. Then the subdomains start narrating the operation the way the AMOS stage beacons did, just in the names instead of the URLs: generatee4026c.host06q.cfd and sharee4026c.host06q.cfd — generate and share, two API verbs wearing hostnames, both carrying the same 4026c token that reads like a campaign ID.

Four TLS sessions go up to that pair of IPs between t+39s and t+43s; one of them stays open for 245 seconds. This is what PcapAI’s four T1573.001 (Encrypted Channel: Symmetric Cryptography) detections point at — post-handshake payloads measuring entropy 7.66–7.73, effectively random bytes, which is exactly what an encrypted C2 channel looks like from the outside. Two more domains flash by and are never touched again — beta6.fastlinkpulse.click and lan31.swiftlinktap.click, single-visit redirect hops with names generated by the pound. Every one of these hosts resolves to Cloudflare edge space. The infrastructure has no face: no hosting provider to complain to that is not also fronting a million legitimate sites.

t+46s — twelve megabytes, and the direction test

At t+45.8s the biggest flow of the capture opens: i2seperefiles.com — a name cosplaying as a file-sharing service — on yet another Cloudflare IP, 104.21.5.95. The connection lives 479 seconds and carries 12 MB, and the report’s executive summary calls it “unauthorized transfer of 12 MB of data to 104.21.5.95… active exfiltration.” The report also — to its credit — files an explicit indicator telling you to verify what actually moved. So verify: open Statistics → Conversations, look at the per-direction columns.

Wireshark → Statistics → Conversations (TCP)

endpoint A            endpoint B               A→B        B→A       duration
10.6.22.216:64061  ↔  104.21.5.95:443       232 kB      12 MB      479.3 s
10.6.22.216:49162  ↔  104.21.35.23:443    2,246 kB      70 kB       10.8 s

The 12 MB moved toward the Mac — 12 MB down, 232 kB up. That flow is not loot leaving; it is delivery — the disk image, a second stage, whatever the download button was serving. The capture cannot name the file, but it can prove which way the bytes went, and direction is the difference between “we lost 12 MB of data” and “12 MB of malware arrived.” The row below it is the real theft, and we will get there at t+236s.

The download itself is violent. The report’s burst analysis puts 12.8 MB inside one window around t+40s — roughly 30× the capture’s average rate — and 3,140 of the flow’s 3,141 retransmissions land inside a single second and a half (t+46.8 to t+48.3), a 31.13% retransmission rate overall with 666 duplicate ACKs. While that firehose ran, the Mac started zero-windowing its other connections — stats.wp.com, itunes.apple.com, Apple’s safe-browsing token service — eight zero-window events of a host too busy being infected to answer its own OS telemetry. That is the entire Network Issues 60/100 score: one malicious flow, seen from the performance side.

t+138s — a domain only a machine could love

Ninety seconds of quiet, then the second act. At t+138.1s the host resolves 8790tn5c190y51v7n2.com — eighteen characters of keyboard noise, the kind of name no marketing department ever approved. Two frames later it asks api.ipify.org “what is my public IP?” — a legitimate free service, beloved of stealers, and a textbook T1016.001 (Internet Connection Discovery): the implant geolocating its new victim. A 77 kB pull from the new domain follows, sized like a config or a small module.

There is a quieter tell in the port numbers. The browsing session — lure site, WordPress assets, Apple services — walks the ephemeral range from 64043 upward all capture long. The connections to 8790tn….com and api.ipify.org start fresh at exactly 49152 — the bottom of the IANA ephemeral range — and count up on their own. Two port sequences, interleaved in time: what it reads as is two different programs on one machine, the browser that started this and the implant it installed.

t+236s — the actual exfiltration takes eleven seconds

Between t+228s and t+250s the implant opens seven quick sessions to 8790tn5c190y51v7n2.com. Six are small. The seventh, at t+236.4s, pushes 2,246 kB from the Mac to the server in 10.8 seconds — the direction column leaves no doubt this time. That is the harvest leaving: on a stealer infection, an upload this size is the browser-credential store, cookies, session tokens, wallet files, whatever the collection modules bagged. TLS hides the manifest — unlike the AMOS capture, we cannot read the file names — but a corporate endpoint pushing two megabytes to an eighteen-character domain minted behind Cloudflare is not a software update.

In ATT&CK terms this is T1041, Exfiltration Over C2 Channel: the loot rides the same encrypted pipe the tasking uses. Note the economics of the whole exchange — 12 MB in, 2.2 MB out, eleven seconds of theft inside a nine-minute capture. If your detection strategy waits for gigabytes to move before it cares, this incident never trips it.

The 61-second heartbeat that outlives the capture

From t+250s to the last frame, the implant settles into a rhythm: an api.ipify.org check, then a call home, every 60.7–60.9 seconds — set the Wireshark time column to deltas and the grid is impossible to miss:

t+310.6s  api.ipify.org   t+310.8s  8790tn5c190y51v7n2.com
t+371.3s  api.ipify.org   t+371.5s  8790tn5c190y51v7n2.com   +60.7s
t+432.0s  api.ipify.org   t+432.2s  8790tn5c190y51v7n2.com   +60.7s
t+492.8s  api.ipify.org   t+493.0s  8790tn5c190y51v7n2.com   +60.8s
t+553.6s  api.ipify.org   t+553.9s  8790tn5c190y51v7n2.com   +60.9s
                                     capture ends at t+554.3s

Machine-regular, unattended, still checking its own IP before every call — C2 over web protocols (T1071.001) with a one-minute leash. The final beacon fires 0.4 seconds before the capture stops. The pcap ends; the infection does not. Whatever host this was, at t+555 it was still owned.

Where the report is right — and where the packets sharpen it

Automated analysis earns trust on the ambiguous calls, so here is the honest ledger. The big things PcapAI gets right with no human help: the kill chain (confirmed correlation from T1566.002 phishing delivery to T1573.001 encrypted C2 — exactly what the wire shows), the TLD detections, the entropy channels, and the only advice that matters in the first hour: isolate 10.6.22.216 now. Three findings deserve an analyst’s pencil:

The 12 MB “exfiltration” is a delivery. The summary labels the i2seperefiles.com elephant flow as data leaving; the conversation table says 12 MB came in and the true exfil is the 2.2 MB burst at t+236s. The report half-knows this — it files an explicit “verify what moved” indicator, and that check takes one click. The verdict does not change; your incident paperwork does. What left the building is ~2.2 MB of credentials, not 12 MB of files.

“Custom C2 protocol” overstates the weirdness. The structural-anomaly note describes the tunnels as lacking standard TLS handshakes; in Wireshark they parse as well-formed TLS 1.3 — Client Hello, Server Hello, the works. The entropy detection is doing its real job (post-handshake bytes are opaque and random), but what convicts these flows is everything around them: throwaway TLDs, API-verb subdomains, the cadence, the direction. Encrypted C2 mostly looks like correct TLS to the wrong people.

Do not firewall the C2 IPs and call it done. Blocking 104.21.79.198 or 172.67.147.208 means blocking Cloudflare anycast edges shared with legitimate sites — collateral today, useless tomorrow when the domain re-resolves elsewhere. The durable control is the report’s own long-term recommendation: enforce at the DNS layer — sinkhole the five domains, and policy-block the .cfd/.click TLDs if your business does not need them. (Same pencil for the DNS health “Critical” grade: the 0.72 query/response ratio is mostly macOS sending A + HTTPS type-65 query pairs that the resolver half-answers, plus a .cfd authoritative that took 3.1 seconds to cough up an A record. Real signal, wrong villain.)

The report’s security verdict and mitigation list — including the “investigate the 12 MB flow” indicator that, once followed, flips exfiltration into delivery.

The verdict and the runbook

Assembled in order: a fake-software lure on a disposable TLD, a payload delivered from a file-host lookalike, encrypted C2 with API-verb hostnames, an IP check, a 2.2 MB upload, and a one-minute heartbeat still alive at the last frame — a complete stealer kill chain reconstructed without decrypting one byte. PcapAI’s executive summary compresses it into the paragraph you paste into the ticket:

The executive summary: confirmed phishing-to-C2 chain, quarantine and TLD-blocking recommendations, credential reset. One line in it — the 12 MB direction — is the line this post sharpened.

As a runbook: isolate 10.6.22.216 first. Sinkhole all five domains — host06q.cfd (with subdomains), fastlinkpulse.click, swiftlinktap.click, i2seperefiles.com, 8790tn5c190y51v7n2.com — and add TLD policy for .cfd/.click. Then assume the 2.2 MB that left at t+247s was everything a stealer reaches: rotate browser-saved passwords, kill active web sessions (the cookies are gone), move crypto wallets, revoke local API tokens. Image the host before wiping it. Finally, hunt the fleet for the same shape — the SNI list and the 61-second cadence — because lures are rarely visited by exactly one person.

Indicators of compromise

From this public sample — treat as historical, the Cloudflare IPs especially will rotate and are shared infrastructure:

Hunt the same shape in your own PCAPs

None of these exact domains will appear in your traffic. The shape will. Everything in this post came from four questions you can ask any capture, encrypted or not — and the first one is a single tshark line:

tshark -r capture.pcap -Y 'tls.handshake.type == 1' \
  -T fields -e frame.time_relative -e ip.dst -e tls.handshake.extensions_server_name

39.167   104.21.79.198   generatee4026c.host06q.cfd
43.197   104.21.79.198   sharee4026c.host06q.cfd
45.796   104.21.5.95     i2seperefiles.com
138.137  104.21.35.23    8790tn5c190y51v7n2.com

• Read every SNI in the capture. TLS encrypts pages, not destinations. Sort the list and eyeball TLDs (.cfd, .click, .top…) and label shapes — an 18-character alphanumeric domain is its own confession.
• Check direction before you say “exfiltration.” Statistics → Conversations, per-direction byte columns. Big inbound = delivery; sustained or bursty outbound to a young domain = theft.
• Treat IP-echo services as a tripwire. api.ipify.org and friends from a corporate endpoint, on a timer, is malware asking where it woke up.
• Look for a metronome. Fixed-interval connections to one destination — here 60.7–60.9s for five straight cycles — do not happen by accident. Humans are never that punctual.

*Based on this 16 MB, 14,874-packet capture.