Multi-Stage Malware Analysis (Pushdo & Gozi)

Case 04

Score: 30 / 30

Evidence Provided

• One pcap network capture

This was the fourth practical investigation case I completed as part of my CyberOps coursework. The case focused on a compromised workstation in a HaiTek Ltd environment, where the goal was to reconstruct the infection chain from packet evidence and supporting security alerts.

After importing the provided PCAP into the analysis environment, I reviewed the generated alerts in Security Onion and Kibana, then verified the interesting findings in Wireshark. The early indicators pointed to suspicious unencrypted binary downloads, including executable files retrieved by the affected host.

The traffic then moved into post-infection behavior. The workstation checked its public IP address through OpenDNS and contacted infrastructure consistent with Pushdo command-and-control activity. I also identified encrypted outbound traffic to another destination where the packet contents could not be inspected directly, so I used JA3 fingerprinting to support the identification of Gozi banking trojan activity.

One of the clearest confirmation points was traffic toward infrastructure associated with a known sinkhole. The response behavior helped show that the malware family and infrastructure were already being tracked by security researchers, which strengthened the overall conclusion.

The final analysis combined Suricata alerts, packet-level evidence, external intelligence checks, and timeline reconstruction. This case was especially useful practice for following a multi-stage malware incident from download activity through command-and-control communication and validation of indicators.

Technical Report

The final submission was prepared as a technical report documenting the investigation and its findings. The report reconstructs the incident chronologically and examines the key evidence used to determine how the infection progressed and what systems, files, and external infrastructure were involved. It includes a timeline of significant events, analysis of IDS alerts and network traffic, identified malicious files and command-and-control infrastructure, as well as the main conclusions and recommended follow-up actions. The findings are supported by selected evidence from Security Onion, Kibana, Wireshark, VirusTotal, and other threat-intelligence sources.

The original submission was written in Finnish; the English version below is otherwise similar in content.

View PDF directly