Public PCAP Threat Teardowns
Real automated triage outputs from Malware-Traffic-Analysis exercises, adversary emulation captures, and historic network malware samples.
WannaCry EternalBlue SMBv1 PCAP Analysis: MS17-010 Exploit, DoublePulsar and Killswitch
192.168.116.149 exploited 192.168.116.138 over SMBv1 using the MS17-010 (EternalBlue) buffer overflow, then pinged the DoublePulsar backdoor it installed.
Brad Duncan MTA: Qakbot (Qbot) Infection Traffic Teardown
End-to-end packet forensics of the bb02 Qakbot infection chain: malspam lure, password-protected ZIP delivery, ISO mounting, regsvr32 execution, and TLS C2 beaconing.
TA551 Trickbot with Cobalt Strike PCAP Analysis & Teardown
Victim 172.16.3.130 fetched a TA551 macro payload from testmahoneyd.com, executing Trickbot (gtag: zev2) before pulling Cobalt Strike Beacon DLL (105.dll) and initiating persistent HTTPS C2 beaconing.
Have a Capture File You Need to Triage Right Now?
Upload your PCAP or CAP file to NetNerve. Our dual AI-engine and 40,000+ Suricata IDS signatures extract SSIDs, credentials, C2 beacons, and malware traffic in seconds.