Analyzing Kelihos SPAM in CapLoader and NetworkMiner

This network forensics video tutorial covers how to analyze SPAM email traffic from the Kelihos botnet. The analyzed PCAP file comes from the Stratosphere IPS project, where Sebastian Garcia and his colleagues execute malware samples in sandboxes. The particular malware sample execution we are looking at this time is from the CTU-Malware-Capture-Botnet-149-2 dataset.

Resources

• Stratosphere IPS dataset: CTU-Malware-Capture-Botnet-149-2
• CapLoader
• nfdump
• SiLK
• Argus
• Alexa's Top 1 Milion Domain List
• Cisco Ubrella Popularity List
• MaxMind
• Emerging Threats' TROJAN Win32/Kelihos.F Checkin Signature
• NetworkMiner

IOCs
990e5daa285f5c9c6398811edc68a659
e4f7fa6a0846e4649cc41d116c40f97835d3bb7d3d0391d3540482f077aa4493
6c55 5545 0310 4840

Check out our series of network forensic video tutorials for more tips and tricks on how to analyze captured network traffic.

Posted by Erik Hjelmvik on Monday, 19 February 2018 06:37:00 (UTC/GMT)

Tags: #Netresec​ #PCAP​ #CapLoader​ #NetworkMiner​ #videotutorial​ #video​ #tutorial​ #NetFlow​ #extract​ #Stratosphere​