Investigating NullMixer Network Traffic: Utilizing Suricata and Evebox (Part 3)

Inspecting network traffic can often give you unique insight into the malware you are investigating. in this video, we'll take a look at network traffic from our NullMixer sample and use Suricata to generate IDS alerts. We'll also take advantage of the light weight UI called Evebox, which allows us to easily navigate through Suricata's output - which includes more than just the network alerts.

Tools covered: Suricata, EveBox

Sample SHA256 (available on Triage): 7a4df2fc82c0b553d0b703f51635fd62cf02553706f942c66d752c1d8fae207b

Suri install - https://youtu.be/zK7x43Ghn4E

EveBox …

alerts called ids insight malware network network traffic suricata tools traffic video