For more help, you can follow this guide on how to verify the hash. This step is needed in order to verify the integrity of the file. Then when the PCAP file is received, check that the hash is the same.

Record the hash of the PCAP file on the beneficiary machine that was used to capture the traffic.

Follow this guide to capture a phone’s traffic.

Follow this guide on using tcpdump in command line if Wireshark is not an option.

Follow this guide for analysis on laptops.

Capture the traffic for at least 2 hours and ideally for 24 hours as malware beacons can be done once daily. Assist the beneficiary in creating and exporting a PCAP file capturing the traffic of the device that shows suspicious behavior.Host-based investigation ( Article #367: Live Forensics for Windows and Article #368: Live Forensics for Linux) has led to no result or it is not an option. ProblemĪ system is behaving strangely and you need to conduct a network perimeter analysis to check if it is compromised.

Edit me PCAP File Analysis with Wireshark to investigate Malware infection How to analyze a PCAP file using Wireshark.

Malware traffic analysis wireshark