Analyzes network traffic generated by malware during sandbox execution or live incident response to identify C2 protocols, data exfiltration channels, payload downloads, and lateral movement patterns using Wireshark, Zeek, and Suricata. Activates for requests involving malware network analysis, C2 traffic decoding, malware PCAP analysis, or network-based malware detection.
Instrucciones de origen · Vista previa de solo lectura
name
analyzing-network-traffic-of-malware
description
Analyzes network traffic generated by malware during sandbox execution or live incident response to identify C2 protocols, data exfiltration channels, payload downloads, and lateral movement patterns using Wireshark, Zeek, and Suricata. Activates for requests involving malware network analysis, C2 traffic decoding, malware PCAP analysis, or network-based malware detection.
Sandbox execution has captured a PCAP file and the network behavior needs detailed analysis
Identifying the C2 protocol structure for writing network detection signatures
Determining what data the malware exfiltrates and to which external infrastructure
Analyzing DNS tunneling, domain generation algorithms (DGA), or fast-flux behavior
Creating Suricata/Snort signatures based on observed malware network patterns
Do not use for host-based analysis of malware behavior; use Cuckoo sandbox reports or Volatility memory analysis for process-level activity.
Detection Gaps & Validation
No traffic is not no C2. Many samples sleep, geofence, or require a live C2 before beaconing - an empty PCAP from a sandbox often means evasion (VM/sandbox checks, killswitch domain unreachable), not a benign binary. Re-run with internet simulation (INetSim/FakeNet-ng) before concluding.
Beacon detection misses jittered/long-sleep C2. The jitter < 30% heuristic skips Cobalt Strike profiles with high jitter or hour-scale sleeps. Lengthen the capture window and analyze packet-size regularity, not just interval regularity.
Encrypted payloads hide the verdict. Without TLS interception you only see SNI/JA3/cert metadata - validate by pulling JA3/JA3S against known-bad sets, checking SNI vs. certificate CN/SAN mismatch, and flagging self-signed or freshly issued certs.
DGA and DNS/ICMP channels evade HTTP-only analysis. Domains may be algorithmic or absent (hardcoded IPs); data may ride DNS TXT or ICMP. Run the entropy check across all qtypes and inspect non-TCP carriers.
Confirm a hit by extracting transferred files with Zeek/NetworkMiner, hashing them, and re-scanning with YARA - then write a Suricata rule and replay the PCAP to verify it fires.
Benign lookalikes: CDN fetches, OS/AV telemetry, NTP, and cloud SDK keepalives mimic beaconing. Validate destination IP/ASN reputation before flagging regular traffic as C2.
Prerequisites
Wireshark 4.x installed for interactive PCAP analysis
tshark (Wireshark CLI) for scripted packet extraction
Zeek installed for automated metadata generation from PCAPs
Suricata with ET Open/ET Pro rulesets for signature matching
NetworkMiner for file extraction and credential detection from PCAPs
Python 3.8+ with scapy and dpkt for programmatic packet analysis
Workflow
Step 1: Initial PCAP Overview
Get a high-level understanding of the network traffic:
Identify regular periodic communication indicating C2 beaconing:
# Beacon detection from PCAPfrom scapy.allimport rdpcap, IP, TCP
from collections import defaultdict
import statistics
packets = rdpcap("malware.pcap")
# Group connections by destination IP:port
connections = defaultdict(list)
for pkt in packets:
if IP in pkt and TCP in pkt:
if pkt[TCP].flags & 0x02: # SYN flag
dst = f"{pkt[IP].dst}:{pkt[TCP].dport}"
connections[dst].append(float(pkt.time))
# Analyze timing intervals for beaconingprint("Beacon Analysis:")
for dst, times in connections.items():
iflen(times) >= 5:
intervals = [times[i+1] - times[i] for i inrange(len(times)-1)]
avg = statistics.mean(intervals)
stdev = statistics.stdev(intervals) iflen(intervals) > 1else0
jitter = (stdev / avg * 100) if avg > 0else0if10 < avg < 3600and jitter < 30: # Regular interval with < 30% jitterprint(f" [!] {dst}: {len(times)} connections")
print(f" Interval: {avg:.1f}s ± {stdev:.1f}s (jitter: {jitter:.1f}%)")
print(f" Pattern: LIKELY BEACONING")
Step 5: Generate Network Detection Signatures
Create Suricata/Snort rules from observed traffic patterns:
# Run Suricata against the PCAP for existing signature matches
suricata -r malware.pcap -l suricata_output/ -c /etc/suricata/suricata.yaml
# Review alertscat suricata_output/fast.log
# Create custom Suricata rule from observed patternscat << 'EOF' > custom_malware.rules
# C2 beacon detection based on observed URI pattern
alert http $HOME_NET any -> $EXTERNAL_NET any (
msg:"MALWARE MalwareX C2 Beacon";
flow:established,to_server;
http.method; content:"POST";
http.uri; content:"/gate.php?id=";
http.user_agent; content:"Mozilla/5.0 (compatible; MSIE 10.0)";
sid:9000001; rev:1;
)
# DNS query for known C2 domain
alert dns $HOME_NET any -> any any (
msg:"MALWARE MalwareX C2 DNS Query";
dns.query; content:"update.malicious.com";
sid:9000002; rev:1;
)
# JA3 hash match for malware TLS client
alert tls $HOME_NET any -> $EXTERNAL_NET any (
msg:"MALWARE MalwareX JA3 Match";
ja3.hash; content:"a0e9f5d64349fb13191bc781f81f42e1";
sid:9000003; rev:1;
)
EOF
Step 6: Extract Files and Artifacts from Traffic
Recover transferred files and embedded data:
# Extract files using Zeek
zeek -r malware.pcap /opt/zeek/share/zeek/policy/frameworks/files/extract-all-files.zeek
ls extract_files/
# Extract files using NetworkMiner (GUI)# Or use tshark for specific protocol exports
tshark -r malware.pcap --export-objects http,http_objects/
tshark -r malware.pcap --export-objects smb,smb_objects/
tshark -r malware.pcap --export-objects tftp,tftp_objects/
# Hash all extracted filessha256sum http_objects/* smb_objects/* 2>/dev/null
# Generate Zeek logs for comprehensive metadata
zeek -r malware.pcap
# Output: conn.log, dns.log, http.log, ssl.log, files.log, etc.
Key Concepts
Term
Definition
Beaconing
Regular periodic connections from malware to C2 server, identifiable by consistent time intervals and packet sizes
JA3/JA3S
TLS fingerprinting method creating a hash from ClientHello/ServerHello parameters to uniquely identify malware TLS implementations
DGA (Domain Generation Algorithm)
Algorithm generating pseudo-random domain names that malware queries to locate C2 servers, evading static domain blocklists
DNS Tunneling
Encoding data in DNS queries and responses to establish a C2 channel or exfiltrate data through DNS infrastructure
Fast Flux
DNS technique rapidly rotating IP addresses for a domain to avoid takedown and distribute C2 across many compromised hosts
SNI (Server Name Indication)
TLS extension revealing the hostname the client is connecting to; visible even in encrypted HTTPS connections
Network Signature
Suricata/Snort rule matching specific patterns in network traffic (headers, payloads, timing) to detect malicious communications
Tools & Systems
Wireshark: Open-source packet analyzer for deep interactive inspection of network traffic at the protocol level
Zeek: Network analysis framework generating structured metadata logs (conn, dns, http, ssl) from live or captured traffic
Suricata: High-performance network IDS/IPS for signature-based detection with Lua scripting for custom detection logic
NetworkMiner: Network forensic analysis tool for extracting files, images, and credentials from PCAP files
Scapy: Python packet manipulation library for programmatic packet analysis, beacon detection, and protocol decoding
Common Scenarios
Scenario: Decoding a Custom Binary C2 Protocol
Context: Malware communicates with its C2 server using a custom binary protocol over TCP port 8443. Standard HTTP analysis yields no results. The protocol structure needs to be reverse engineered from the PCAP.
Approach:
Filter the PCAP for TCP port 8443 conversations and follow the TCP stream
Identify the message framing (length prefix, delimiter, fixed-size headers)
Compare multiple messages to identify static header fields vs variable data fields
Cross-reference with reverse engineering findings from Ghidra (if the binary was analyzed)
Write a Wireshark dissector or Scapy parser for the custom protocol
Create Suricata rules matching the static header bytes for network detection
Document the full protocol specification for threat intelligence sharing
Pitfalls:
Analyzing only the first few packets; some C2 protocols change behavior after initial handshake
Not decrypting TLS traffic when the sandbox has MITM capabilities
Confusing legitimate CDN or cloud traffic with C2 (validate destination IPs)
Missing C2 traffic that uses DNS or ICMP instead of TCP/UDP
Output Format
MALWARE NETWORK TRAFFIC ANALYSIS
===================================
PCAP File: malware_sandbox.pcap
Duration: 300 seconds
Total Packets: 12,847
Total Bytes: 4.2 MB
DNS ACTIVITY
Total Queries: 47
DGA Detected: Yes (23 high-entropy queries to .com TLD)
Tunneling: No
Resolved C2: update.malicious[.]com -> 185.220.101[.]42
C2 COMMUNICATION
Protocol: HTTPS (TLS 1.2)
Server: 185.220.101[.]42:443
SNI: update.malicious[.]com
JA3 Hash: a0e9f5d64349fb13191bc781f81f42e1
Beacon Interval: 60.2s ± 6.8s (11.3% jitter)
Total Sessions: 237
Data Sent: 147 MB
Data Received: 2.3 MB
Certificate: CN=update.malicious[.]com (self-signed, expired)
PAYLOAD DOWNLOADS
GET /payload.dll from compromised-site[.]com
Size: 98,304 bytes
SHA-256: abc123def456...
Content-Type: application/octet-stream
EXFILTRATION
Method: HTTPS POST to /gate.php
Content-Type: application/octet-stream
Average Size: 15,432 bytes per request
Total Volume: 147 MB over 4 hours
SURICATA ALERTS
[1:2028401] ET MALWARE Generic C2 Beacon Pattern
[1:2028500] ET POLICY Self-Signed Certificate
GENERATED SIGNATURES
SID 9000001: MalwareX HTTP beacon pattern
SID 9000002: MalwareX DNS C2 domain
SID 9000003: MalwareX JA3 TLS fingerprint
