For this exercise, you can download the PCAP from https://github.com/nipunjaswal/networkforensics/blob/master/Ch6/Emoter%20Banking%20Trojan%20Sample/2018-11-14-Emotet-infection-with-IcedID-banking-Trojan.pcap. Let's open the PCAP in NetworkMiner and examine the Hosts tab as follows:
We have sorted the hosts based on the number of packets received by them. We can see that 10.11.14.101 and 185.129.49.19 are found to be receiving the greatest number of packets. Next, looking at the files from the Files tab, we can see that a document and an executable have been found in the ...
