Digital Forensic Investigation of Trojan Attacks in Network using Wireshark, FTK Imager and Volatility

Abstract

Trojan attacks are the most common and serious threat to network users. It is a program that appears to be useful program but actually harmful one. It is difficult to detect Trojan attacks because it uses special techniques to conceal its activities from antiviruses and users. Thus, this research intends to retrieve and investigate of Trojan attacks on the network using digital forensic tools namely Wireshark, FTK Imager and Volatility. Two types of Trojan attacks called Remote Access Trojan (RAT) and HTTP Trojan (HT) are created and experimented in this research. These Trojans are sent to the targeted computer in the network through email. Wireshark is used to capture the network packets and then analyze the suspicious packets. FTK Imager is used to capture RAM data on targeted computer. Volatility is used to analyze the captured RAM data and extract suspicious process.  This suspicious process is dumped into file and scanned using the Avast antivirus to check whether this process is running Trojan or otherwise. This research may benefit and contribute to the computer security and forensic domain.  It can be extends to investigate other Trojan attacks such as Zeus, SubSeven or Back Orifice by using the same digital forensic tools.