For this exercise, you can download the PCAP from https://github.com/nipunjaswal/networkforensics/blob/master/Ch6/Emoter%20Banking%20Trojan%20Sample/2018-11-14-Emotet-infection-with-IcedID-banking-Trojan.pcap. Let's open the PCAP in NetworkMiner and examine the Hosts tab as follows:
We have sorted the hosts based on the number of packets received by them. We can see that 10.11.14.101 and 185.129.49.19 are found to be receiving the greatest number of packets. Next, looking at the files from the Files tab, we can see that a document and an executable have been found in the capture:
Next, let's calculate its checksum to search for it on sites such as VirusTotal and Hybrid-Analysis, as shown in the following screenshot:
We can see that we have the signatures generated as follows:
Let&apos...
