Investigating network activity

Since most malware needs to communicate with a command-and-control server, download additional modules, or send some data, the appearance of network connections is unavoidable. However, before going on to investigate network connections, it would be a good idea to find out which network interfaces were used on our host and how they were configured. To do this, we can use the Volatility linux_ifconfig plugin, which provides all the necessary information in the following way:

Figure 9.1 – Information about network interfaces

In the output, we can see that there are three interfaces used on the investigated host:

• lo – A loopback interface with the standard 127.0.0.1 IP address
• ens33 – A network interface with the 192.168.168.144 IP address
• ens38 – A network interface with the 192.168.3.133 IP address

We can now start investigating active network connections. For this purpose, Volatility...