Investigate this using the instructions below and note the domains and the resolved IPs. Most of the time one or more name resolutions take place. PCAP Analysis: Option 1įollowing its executions, a malware usually attempts to connect to its command and control (C2) server. Please escalate the case if you run into any issues when following these steps, or if none of these reveal any results. These steps can be performed in any order. In our analysis of the PCAP file, we will try three analysis techniques to find any indicators of malicious activity. To load a PCAP file in Wireshark, open Wireshark and in the menu bar, click ‘File’, then click ‘Open’ and navigate to the file’s location, then click ‘Open.’ It will also change the time display to a readable version. This configuration will make the requested domains and connected hosts clearer to you. In order to make the analysis easier, make sure Wireshark is configured following this tutorial. Other options can be found in Article #282: Recommendations on Secure File Sharing and File Storage.

If not we can use a peer-to-peer file sharing channel such as Onionshare.

The file can be sent over email if its size allows that.

For more help, you can follow this guide on how to verify the hash. This step is needed in order to verify the integrity of the file. Then when the PCAP file is received, check that the hash is the same.

Record the hash of the PCAP file on the beneficiary machine that was used to capture the traffic.

Follow this guide to capture a phone’s traffic.

Follow this guide on using tcpdump in command line if Wireshark is not an option.

Follow this guide for analysis on laptops.

Capture the traffic for at least 2 hours and ideally for 24 hours as malware beacons can be done once daily.

Assist the beneficiary in creating and exporting a PCAP file capturing the traffic of the device that shows suspicious behavior.

Host-based investigation ( Article #367: Live Forensics for Windows and Article #368: Live Forensics for Linux) has led to no result or it is not an option. ProblemĪ system is behaving strangely and you need to conduct a network perimeter analysis to check if it is compromised.

Edit me PCAP File Analysis with Wireshark to investigate Malware infection How to analyze a PCAP file using Wireshark.

Pcap analysis tools