Trending

#PCAP

Latest posts tagged with #PCAP on Bluesky

Latest Top

Posts tagged #PCAP

Brad
Brad
@malware-traffic-analysis.net
2 days ago
SmartApeSG script injected into page from compromised website.

SmartApeSG script injected into page from compromised website.

SmartApeSG fake CAPTCHA page with ClickFix instructions.

SmartApeSG fake CAPTCHA page with ClickFix instructions.

Malware delivered through SmartApeSG persistent on an infected Windows host.

Malware delivered through SmartApeSG persistent on an infected Windows host.

2026-04-06 (Monday): #ClickFix activity from the #SmartApeSG campaign. Not sure what malware was sent through the fake CAPTCHA page is this time, but it's not the usual.

Indicators, a #pcap of the traffic, malware samples and other info available at malware-traffic-analysis.net/2026/04/06/i...

3 1 0 0
D.C. Douglas
D.C. Douglas
@dcdouglas.com
2 weeks ago
Preview
Star Wars Voices: Tom Keegan Controls The Galaxy Explore the directing talents of Tom Keegan on video games like Star Wars Jedi, Indiana Jones, Wolfenstein II and more

#starwars #indianajones #pcap #videogames dcdouglas.com/talent-spotl...

1 1 0 0
Dan Hansen
Dan Hansen
@danhansen-peqapps.bsky.social
2 weeks ago
Capture File Forensics running on a MacBook Air

Capture File Forensics running on a MacBook Air

Capture File Forensics 4.4 has been released.

Uncover the security, performance, and configuration issues lurking in your capture files.

#NetworkAnalysis #pcap #networking #network #cyber #security #Wireshark

0 0 0 0
DFRWS
DFRWS
@dfrws.bsky.social
4 weeks ago
✨ DFRWS EU 2026 Workshops Led by Erik Hjelmvik (Netresec, Sweden), the session is designed for practitioners and researchers working with network and memory forensics in real-world investigations. 📍 Workshop Dates 23–24 March 2026 🧿 Details here: https://buff.ly/oT8OtbE

✨ DFRWS EU 2026 Workshops Led by Erik Hjelmvik (Netresec, Sweden), the session is designed for practitioners and researchers working with network and memory forensics in real-world investigations. 📍 Workshop Dates 23–24 March 2026 🧿 Details here: https://buff.ly/oT8OtbE

✨ DFRWS EU 2026 Workshops

Led by Erik Hjelmvik (Netresec, Sweden), the session is designed for practitioners and researchers working with network and memory forensics in real-world investigations.

📍 Workshop Dates 23–24 March 2026
🧿 Details here: buff.ly/oT8OtbE

#MemoryForensics #PCAP #TOR

1 1 0 0
Android
Android
@android.activitypub.awakari.com.ap.brid.gy
1 month ago
Preview
Российский мессенджер MAX замечен в обращении к иностранным сервисам определения IP и серверам конкурентов Пользователи профильного NTC‑форума (открывается только через IPv6), посвященного исследованиям интернет‑цензуры и обхода блокировок, обнаружили необычное сетевое поведение российского мессенджера...

Российский мессенджер MAX замечен в обращении к иностранным сервисам определения IP и серверам конкурентов П...

#max #макс #мессенджер #android #pcapdroid #pcap #vpn #прокси #geoip

Origin | Interest | Match

0 0 0 0
Android
Android
@android.activitypub.awakari.com.ap.brid.gy
1 month ago
Preview
Российский мессенджер MAX замечен в обращении к иностранным сервисам определения IP и серверам конкурентов Пользователи профильного NTC‑форума (открывается только через IPv6), посвященного исследованиям интернет‑цензуры и обхода блокировок, обнаружили необычное сетевое поведение российского мессенджера...

Российский мессенджер MAX замечен в обращении к иностранным сервисам определения IP и серверам конкурентов П...

#max #макс #мессенджер #android #pcapdroid #pcap #vpn #прокси #geoip

Origin | Interest | Match

0 0 0 0
Android
Android
@android.activitypub.awakari.com.ap.brid.gy
1 month ago
Российский мессенджер MAX замечен в обращении к иностранным сервисам определения IP и серверам конкурентов

Российский мессенджер MAX замечен в обращении к иностранным сервисам определения IP и серверам конкурентов П...

#android #geoip #max #pcap #pcapdroid #vpn #Макс #мессенджер #прокси

Origin | Interest | Match

0 0 0 0
Veronica Barrera
Veronica Barrera
@veronicabarreravo.bsky.social
1 month ago
Video

Hey Everyone! Super excited for my latest guest @ivansherry1! It was such a great discussion, thank you so much for being on the show. Tune in next week for @taryn_up_vo! buff.ly/Enxwayu Thank you so much for listening and your support!
#voiceactingstories #voiceacting #podcast #mocap #pcap

1 0 0 0
Dan Hansen
Dan Hansen
@danhansen-peqapps.bsky.social
2 months ago
Capture File Forensics running on a MacBook Air

Capture File Forensics running on a MacBook Air

Capture File Forensics 4.3 has been released.

Uncover the security, performance, and configuration issues lurking in your capture files.

#NetworkAnalysis #pcap #networking #network #cyber #security #Wireshark

0 0 0 0
Brad
Brad
@malware-traffic-analysis.net
2 months ago
Screenshot of my blog post with the files and information from this infection.

Screenshot of my blog post with the files and information from this infection.

Screenshot of the email with an attached RAR archive.

Screenshot of the email with an attached RAR archive.

The malware, extracted from the attached RAR archive.

The malware, extracted from the attached RAR archive.

Traffic from the infection filtered in Wireshark.

Traffic from the infection filtered in Wireshark.

2026-02-03 (Tuesday): #GuLoader for #AgentTesla style malware with FTP data exfiltration. A #pcap of the infection traffic, associated files, and a list of indicators are available at www.malware-traffic-analysis.net/2026/02/03/i...

4 1 0 0
NETRESEC - Network Forensics and Network Security Monitoring
NETRESEC - Network Forensics and Network Security Monitoring
@netresec.com.web.brid.gy
2 months ago
Preview
Decoding malware C2 with CyberChef This video tutorial demonstrates how malware C2 traffic can be decoded with CyberChef. The PCAP files with the analyzed network traffic can be downloaded from malware-traffic-analysis.net. CyberChef recipe to decode the reverse shell traffic to 103.27.157.146:4444: From_Hex('Auto') XOR({'option':'He[...]
0 0 0 0
Brad
Brad
@malware-traffic-analysis.net
2 months ago
Post image

2026-01-19 (Monday): Catching up on two infections in my lab from last week, and I added an entry with a #pcap of scans and probes and web traffic hitting my web server. Feel free to check out my latest posts at www.malware-traffic-analysis.net/2026/index.h...

Or not. I'm not the boss of you.

5 1 1 0
Raúl Prieto Fernández
Raúl Prieto Fernández
@raulprietofdez.bsky.social
2 months ago
Preview
Cómo juntar y dividir ficheros pcap Nota: El procedimiento es válido tanto para GNULinux como para Windows.Un buen administrador de sistemas debe conocer el uso de la herramienta TCPDump y Wireshark si quiere conseguir averiguar cual es el problema que está causando el mal rendimiento de su red.Muchas veces, los administradores, hac...

🚀 Descubre cómo juntar y dividir ficheros pcap en segundos! Ideal para analistas de red y entusiastas. ¿Listo para optimizar tu flujo de trabajo? 🔧💡 #pcap #networkanalysis #techtips

1 0 0 0
Brad
Brad
@malware-traffic-analysis.net
2 months ago
Some of the scans, probes, and web traffic from the pcap filtered in Wireshark.

Some of the scans, probes, and web traffic from the pcap filtered in Wireshark.

HTTP stream of the last HTTP request in the pcap showing a POST request that retrieves malicious content from a server at 91.92.241[.]10.

HTTP stream of the last HTTP request in the pcap showing a POST request that retrieves malicious content from a server at 91.92.241[.]10.

Using the wget command to retrieve one of the malicious files from the server at 91.92.241[.]10 on Sunday, 2026-01-11.

Using the wget command to retrieve one of the malicious files from the server at 91.92.241[.]10 on Sunday, 2026-01-11.

Example of a shell script downloaded from 91.92.241[.]10 on Sunday, 2026-01-11, likely for Mirai botnet malware.

Example of a shell script downloaded from 91.92.241[.]10 on Sunday, 2026-01-11, likely for Mirai botnet malware.

2026-01-10 (Saturday): Ten days of scans, probes, and web traffic hitting my web server. A #pcap of the traffic is available at www.malware-traffic-analysis.net/2026/01/10/i...

3 0 0 0
Brad
Brad
@malware-traffic-analysis.net
2 months ago
Screenshot of the email, its attachment, and the VBS file within the attachment for VIP Recovery malware.

Screenshot of the email, its attachment, and the VBS file within the attachment for VIP Recovery malware.

Traffic from the infection filtered in Wireshark.

Traffic from the infection filtered in Wireshark.

TCP stream of the unencrypted SMTP traffic from one of the data exfiltration emails sent by my infected lab host.

TCP stream of the unencrypted SMTP traffic from one of the data exfiltration emails sent by my infected lab host.

Screenshot of the start of my blog post with information on this VIP Recovery infection.

Screenshot of the start of my blog post with information on this VIP Recovery infection.

2026-01-09 (Friday): #VIPRecovery infection from an email attachment. A #pcap of the infection traffic, associated files, and more information are available at www.malware-traffic-analysis.net/2026/01/09/i...

5 0 0 0
Brad
Brad
@malware-traffic-analysis.net
3 months ago
Fake CAPTCHA window and ClickFix script after visiting legitimate, but compromised website.

Fake CAPTCHA window and ClickFix script after visiting legitimate, but compromised website.

Traffic from the infection filtered in Wireshark (part 1 of 2).

Traffic from the infection filtered in Wireshark (part 1 of 2).

Traffic from the infection filtered in Wireshark (part 2 of 2).

Traffic from the infection filtered in Wireshark (part 2 of 2).

Screenshot from the start of the page for this blog post.

Screenshot from the start of the page for this blog post.

2026-01-08 (Thursday): Got a full infection from #KongTuke campaign #ClickFix activity today. Traffic from the infection in two #pcap files, the associated malware, artifacts, and further information is available at www.malware-traffic-analysis.net/2026/01/08/i...

3 0 0 0
Brad
Brad
@malware-traffic-analysis.net
3 months ago
One of the emails and its associated attachment for MassLogger malware.

One of the emails and its associated attachment for MassLogger malware.

Traffic from the infection filtered in Wireshark.

Traffic from the infection filtered in Wireshark.

Example of a data exfiltration email sent from an infected host in my lab.

Example of a data exfiltration email sent from an infected host in my lab.

2026-01-07 (Wednesday): #MassLogger infection from email attachment. Copies of the emails, associated malware, indicators, and a #pcap of the infection traffic are available at www.malware-traffic-analysis.net/2026/01/07/i...

3 1 0 0
Brad
Brad
@malware-traffic-analysis.net
3 months ago
Example of a legitimate but compromised site showing the SmartApeSG fake CAPTCHA page.

Example of a legitimate but compromised site showing the SmartApeSG fake CAPTCHA page.

HTTPS URLs from the infection run.

HTTPS URLs from the infection run.

Traffic from an infection filtered in Wireshark.

Traffic from an infection filtered in Wireshark.

Remcos RAT infection persistent on an infected Windows host.

Remcos RAT infection persistent on an infected Windows host.

2026-01-06 (Tuesday): #SmartApeSG CAPTCHA page uses #ClickFix technique to push #RemcosRAT, with #Remcos #RAT C2 server at 192.144.56[.]80. A #pcap of the traffic, the Remcos RAT #malware, and a list of indicators are available at www.malware-traffic-analysis.net/2026/01/06/i...

6 2 0 0
Brad
Brad
@malware-traffic-analysis.net
3 months ago
A screenshot of my blog post for the Lumma Stealer infection

A screenshot of my blog post for the Lumma Stealer infection

Traffic from the Lumma Stealer infection filtered in Wireshark.

Traffic from the Lumma Stealer infection filtered in Wireshark.

2026-01-01 (Thursday): #LummaStealer infection with follow-up malware. A #pcap of the infection traffic, the #Lumma #Stealer files, and a list of IOCs are available at www.malware-traffic-analysis.net/2026/01/01/i...

3 1 0 0
linux
linux
@linux.activitypub.awakari.com.ap.brid.gy
3 months ago
Preview
PCredz review (extract data from pcap files) PCredz is a tool to extract sensitive data from pcap files like credit card numbers, session information, and authentication details.



#Data #extraction #pcap

Origin | Interest | Match

0 0 0 0
Brad
Brad
@malware-traffic-analysis.net
3 months ago
Screenshot of my blog post to share information on this Lumma Stealer infection with follow-up malware.

Screenshot of my blog post to share information on this Lumma Stealer infection with follow-up malware.

2025-12-30 (Tuesday): #LummaStealer infection with follow-up malware. A #pcap of the infection traffic, the associated #Lumma with follow-up #malware samples, and some IOCs are available at www.malware-traffic-analysis.net/2025/12/30/i...

7 3 0 0
Brad
Brad
@malware-traffic-analysis.net
3 months ago
Downloading the initial file, a DMG image.

Downloading the initial file, a DMG image.

Screenshot showing the malicious downloaded DMG image and the associated malicious Mach-O file within the installer.app content.

Screenshot showing the malicious downloaded DMG image and the associated malicious Mach-O file within the installer.app content.

Traffic generated by the MacSync Stealer malware, filtered in Wireshark.

Traffic generated by the MacSync Stealer malware, filtered in Wireshark.

Example of the data exfiltrated through the MacSync Stealer C2 traffic.

Example of the data exfiltrated through the MacSync Stealer C2 traffic.

2025-12-23 (Tuesday): Based on yesterday's Jamf article, I ran the fake installer for #MacSyncStealer in my lab on a macOS host. A #pcap of the #MacSync #Stealer traffic, the associated IOCs, the #malware sample, and a link to the Jamf article are at www.malware-traffic-analysis.net/2025/12/23/i...

3 0 0 0
Dan Hansen
Dan Hansen
@danhansen-peqapps.bsky.social
4 months ago
Capture File Forensics running on a MacBook Air

Capture File Forensics running on a MacBook Air

Capture File Forensics 4.1 has been released.

Uncover the security, performance, and configuration issues lurking in your capture files.

#NetworkAnalysis #pcap #networking #network #cyber #security #Wireshark

1 0 0 0
𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲
𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲
@netresec.com
4 months ago
Preview
NetworkMiner 3.1 Released This NetworkMiner release brings improved extraction of artifacts like usernames, passwords and hostnames from network traffic. We have also made some updates to the user interface and continued our e...

NetworkMiner 3.1 Released!
🔑 More usernames, passwords and hostnames from #PCAP
💻 Improved user interface
👾 Better details from malware C2 traffic
netresec.com?b=25C4039

2 2 0 0
𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲
𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲
@netresec.infosec.exchange.ap.brid.gy
4 months ago
Preview
@netresec

NetworkMiner 3.1 Released!
🔑 More usernames, passwords and hostnames extracted
:terminal: Better user interface
👾 More details from malware C2 traffic
https://netresec.com/?b=25C4039

0 0 0 0
Dan Hansen
Dan Hansen
@danhansen-peqapps.bsky.social
4 months ago
Capture File Forensics version 4.0 running on a MacBook Air

Capture File Forensics version 4.0 running on a MacBook Air

Are Amplification Attacks, SYN Floods, Ping Sweeps, Port Scans, Duplicate IP Addresses, Segment Gaps, ARP Request Storms, Zero Windows ... lurking in your capture files?
Find out with Capture File Forensics version 4.0 apple.co/4onAVxD
#pcap #packetcapture #forensics #security #monitoring #Wireshark

1 0 0 0
𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲
𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲
@netresec.infosec.exchange.ap.brid.gy
4 months ago
castlerat | fa354cf29852573669bc468ea2dac0ea5e83a943315466c89dd8634b38cdb261 | Triage Check this castlerat report malware sample fa354cf29852573669bc468ea2dac0ea5e83a943315466c89dd8634b38cdb261, with a score of 10 out of 10.

The analyzed #PCAP file can be found here:
https://tria.ge/251028-3g9yps1ncr/behavioral1

0 0 1 0
Dan Hansen
Dan Hansen
@danhansen-peqapps.bsky.social
4 months ago
Capture File Forensics 3.1 update announcement

Capture File Forensics 3.1 update announcement

Amplification Attacks, SYN Floods, Ping Sweeps, Port Scans, Duplicate IP Addresses, Segment Gaps, ARP Request Storms, Extraneous Data …

Are they lurking in your capture files? Find out with Capture File Forensics.
apple.co/4onAVxD

#pcap #packetcapture #forensics #security #monitoring #Wireshark

1 0 0 0
Citadel Cybersec
Citadel Cybersec
@citadelcysec.bsky.social
4 months ago
Preview
Network Forensics with NetworkMiner Investigating PCAP files in TryHackMe’s NetworkMiner Room: Tool Overview 2

I uncover data hidden in network traffic, from identifying device information to analyzing anomalous behaviors in my new write-up “Network Forensics with NetworkMiner”.

#CyberSecurity #NetworkForensics #DFIR #PCAP #NetworkMiner

0 0 0 0