
ACF
Android Connections Forensics

Android Connections Forensics

A Zeek based NetSupport detector. NetSupport is often abused by attackers in malware.

Parsing Ramnit's traffic

CVE-2017-0199 XLS --> HTA --> VBS --> STEGANOGRAPHY --> DBATLOADER/GULOADER STYLE MALWARE

Malcom - Malware Communications Analyzer

A package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring.

Visualize network topologies and collect graph statistics based on pcap files

A tool to assist with network-based hunting for GRU's Drovorub malware c2

IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by…