It’s time for another ISC traffic analysis quiz! Like previous quizzes, this one consists of a packet capture (pcap) of infection traffic, and you also get a list of the alerts (both as an image where the alerts are shown in Squil and a text file with more details).
You can find the pcap and alerts here.
What type of infection is this? The alerts file should tell you. I also have a text file with notes that better explains what this infection is, in case the alerts don’t clearly provide you with answers.
This type of analysis requires Wireshark. Wireshark is my tool of choice to review pcaps of infection activity. However, default settings for Wireshark are not optimized for web-based malware traffic. That’s why I encourage people to customize Wireshark after installing it. To help, I’ve written a series of tutorials. The ones most helpful for this quiz are:
Unlike previous exercises, there are no actual malware binaries in the traffic. Some encoded binary objects can be extracted from the pcap, but they are not malicious on their own.
Again, files associated with this quiz (pcap, alerts, and notes) can be found here.
If you found this fun, we have previous traffic analysis quizzes:
brad [at] malware-traffic-analysis.net
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.