Erik Hjelmvik
,
Monday, 26 February 2018 11:19:00 (UTC/GMT)
This network forensics video tutorial covers analysis of a malware redirect chain, where a PC is infected through the RIG Exploit Kit.
A PCAP file, from Brad Duncan's malware-traffic-analysis.net website,
is opened in NetworkMiner Professional in order to follow a redirect chain via a couple of hacked websites before delivering malware to the PC.
Resources
https://www.malware-traffic-analysis.net/2014/11/16/index.html
Meadgive on VirusTotal
CVE-2014-0569 Flash Exploit on VirusTotal
CVE-2012-0507 Java Exploit on VirusTotal
NetworkMiner Professional
IOCs
Check out our series of network forensic video tutorials for more tips and tricks on how to analyze captured network traffic.
Posted by Erik Hjelmvik on Monday, 26 February 2018 11:19:00 (UTC/GMT)
Tags: #Netresec
#Professional
#NetworkMiner
#malware_traffic
#malware
#NSM
#PCAP
#videotutorial
#video
#tutorial
Share:
Short URL:
https://netresec.com/?b=1829909
Erik Hjelmvik
,
Monday, 12 February 2018 08:00:00 (UTC/GMT)
series of network forensic video tutorials covers a quick
and crude way to scan a PCAP file for malware. It's all done locally without having to run the PCAP through an IDS. Kudos to Lenny Hanson for showing me this little trick!
Antivirus Scanning of a PCAP File
Resources
IOCs
Posted by Erik Hjelmvik on Monday, 12 February 2018 08:00:00 (UTC/GMT)
Tags: #Netresec
#PCAP
#video
#tutorial
#videotutorial
#NetworkMiner
#malware
#malware_traffic
Share:
Short URL:
https://netresec.com/?b=1820d24
Erik Hjelmvik
,
Monday, 05 February 2018 07:30:00 (UTC/GMT)
series of network forensics video tutorials
throughout the next few weeks.
First up is this analysis of a PCAP file containing network traffic from the "Zyklon H.T.T.P." malware.
Analyzing a Zyklon Trojan with Suricata and NetworkMiner
Resources https://www.malware-traffic-analysis.net/2017/07/22/index.html https://github.com/Security-Onion-Solutions/security-onion https://www.arbornetworks.com/blog/asert/wp-content/uploads/2017/05/zyklon_season.pdf http://doc.emergingthreats.net/2017930
IOCs
Posted by Erik Hjelmvik on Monday, 05 February 2018 07:30:00 (UTC/GMT)
Tags: #Netresec
#PCAP
#Trojan
#video
#tutorial
#videotutorial
#NetworkMiner
#SecurityOnion
#Suricata
#malware
#network
#forensics
#NSM
#malware_traffic
Share:
Short URL:
https://netresec.com/?b=182b4ac
