-
Book Overview & Buying
-
Table Of Contents
-
Feedback & Rating

Practical Memory Forensics
By :

Since most malware needs to communicate with a command-and-control server, download additional modules, or send some data, the appearance of network connections is unavoidable. However, before going on to investigate network connections, it would be a good idea to find out which network interfaces were used on our host and how they were configured. To do this, we can use the Volatility linux_ifconfig
plugin, which provides all the necessary information in the following way:
Figure 9.1 – Information about network interfaces
In the output, we can see that there are three interfaces used on the investigated host:
lo
– A loopback interface with the standard 127.0.0.1
IP addressens33
– A network interface with the 192.168.168.144
IP addressens38
– A network interface with the 192.168.3.133
IP addressWe can now start investigating active network connections. For this purpose, Volatility...
Change the font size
Change margin width
Change background colour