2026-09-11: Traffic analysis exercise – Kongtuke Rebuke!

This is a classic hands-on packet analysis challenge from Brad Duncan’s site. If you haven’t run through one of these in a while, this is a good weekend lab.

Scenario: You’re given a full PCAP (and often memory/supporting files) from an infected host. The goal is to identify the initial infection vector, C2 traffic, and post-exploit activity.

Technical Breakdown: – Format: Standard malware-traffic-analysis.net exercise. Expect a ZIP containing a PCAP and possibly a JSON log or memory dump. – Typical TTPs: Drive-by download, malicious macro, or exploit kit delivery. C2 over HTTP/HTTPS with beaconing patterns. – IOCs to hunt for: Suspicious DNS queries (DGA or lookalike domains), non-standard user-agent strings, POST requests to /images/ or /admin/ paths, and TLS certificates with odd Subject fields. – MITRE Mapping: T1566 (Phishing), T1204 (User Execution), T1071 (Application Layer Protocol), T1573 (Encrypted Channel).

Defense: Grab the PCAP, fire up Wireshark or Zeek, and follow the TCP streams. Look for the initial HTTP request that delivered the payload—usually a script or Office document. The “Kongtuke” reference suggests a specific malware family or campaign; check the site’s write-up for the exact answer key after you’ve done the analysis. Good practice for incident responders and SOC analysts.

Source: https://www.malware-traffic-analysis.net/2026/09/11/index.html