Digital Forensic Investigation of Trojan Attacks in Network using Wireshark, FTK Imager and Volatility

Digital Forensic Investigation of Trojan Attacks in Network using Wireshark, FTK Imager and Volatility

Authors

  • Muhamad Arif Hashim Universiti Teknologi MARA, Perlis Branch, Arau Campus
  • Iman Hazwam Abd Halim Universiti Teknologi MARA, Perlis Branch, Arau Campus
  • Mohammad Hafiz Ismail Universiti Teknologi MARA, Perlis Branch, Arau Campus
  • Norfaizalfarid Mohd Noor Universiti Teknologi MARA, Perlis Branch, Arau Campus
  • Mohd Faris Mohd Fuzi, Universiti Teknologi MARA, Perlis Branch, Arau Campus
  • Abdul Hapes Mohammed Universiti Teknologi MARA, Perlis Branch, Arau Campus
  • Ray Adderley JM. Gining Universiti Teknologi MARA, Perlis Branch, Arau Campus

Keywords:

Digital forensic, Trojan attack, Wireshark, FTK Imager, Volatility

Abstract

Trojan attacks are the most common and serious threat to network users. It is a program that appears to be useful program but actually harmful one. It is difficult to detect Trojan attacks because it uses special techniques to conceal its activities from antiviruses and users. Thus, this research intends to retrieve and investigate of Trojan attacks on the network using digital forensic tools namely Wireshark, FTK Imager and Volatility. Two types of Trojan attacks called Remote Access Trojan (RAT) and HTTP Trojan (HT) are created and experimented in this research. These Trojans are sent to the targeted computer in the network through email. Wireshark is used to capture the network packets and then analyze the suspicious packets. FTK Imager is used to capture RAM data on targeted computer. Volatility is used to analyze the captured RAM data and extract suspicious process.  This suspicious process is dumped into file and scanned using the Avast antivirus to check whether this process is running Trojan or otherwise. This research may benefit and contribute to the computer security and forensic domain.  It can be extends to investigate other Trojan attacks such as Zeus, SubSeven or Back Orifice by using the same digital forensic tools.

Downloads

Download data is not yet available.

Downloads

Published

2017-06-30

How to Cite

Hashim, M. A., Abd Halim, I. H., Ismail, M. H., Mohd Noor, N., Mohd Fuzi, M. F., Mohammed, A. H., & JM. Gining, R. A. (2017). Digital Forensic Investigation of Trojan Attacks in Network using Wireshark, FTK Imager and Volatility. Journal of Computing Research and Innovation, 2(2), 60–65. Retrieved from https://jcrinn.com/index.php/jcrinn/article/view/43

Issue

Section

General Computing

Most read articles by the same author(s)

1 2 > >> 
Loading...