Garuda - Garba Rujukan Digital

Network Forensic Analysis of a Multi-Stage Async RAT Infection Chain febrian tri hardiyanto; Ashish Jaisan
International Journal of Cyber Engineering Jil. 1 No. 1 (2025): International Journal of Cyber Engineering - December Edition
Publisher : PT Baramedia Literasi Digital

Show Abstract | Download Original | Original Source | Check in Google Scholar | DOI: 10.68404/ijce.v1i1.6

This study investigates the complete infection chain of a multi-stage malware attack culminating in the deployment of the Async Remote Access Trojan (RAT). The primary objective is to identify critical stages of the infection process and derive Indicators of Compromise (IoCs) that can inform effective detection and prevention strategies. Contemporary malware increasingly employs sophisticated delivery mechanisms to evade conventional security defenses, presenting significant challenges for analysts due to multi-stage execution, obfuscation, and covert communication channels. A controlled virtual environment was established to safely execute and monitor the malware sample. Utilizing the Wireshark protocol analyzer and host-based artifact collection, the infection was traced from an ISO disk image file to a Windows Script File (WSF) loader. The analysis revealed a two-stage network communication process: an initial connection to a staging server for payload retrieval, followed by the establishment of an encrypted TLSv1.0 channel to a dynamic DNS-based Command and Control (C2) server operating on a non-standard port. The findings provide distinct IoCs, including network signatures and host-based traces, that can be leveraged for proactive defense. This research demonstrates that Async RAT infections rely on layered delivery mechanisms and encrypted communication channels to bypass detection. The identified IoCs offer actionable intelligence for security practitioners, contributing to the development of robust detection and mitigation strategies against evolving malware threats.

Implementation and Security Analysis on Websites Using HTTPS and SSL Certificates Ariq Naufal; Ashish Jaisan
International Journal of Cyber Engineering Jil. 1 No. 1 (2025): International Journal of Cyber Engineering - December Edition
Publisher : PT Baramedia Literasi Digital

Show Abstract | Download Original | Original Source | Check in Google Scholar | DOI: 10.68404/ijce.v1i1.7

The rapid expansion of web-based services has heightened the importance of secure communication channels to protect sensitive data and ensure user trust. HTTPS, supported by SSL/TLS certificates, has become the de facto standard for securing websites; however, improper implementation and misconfigured certificates continue to expose systems to vulnerabilities. This study presents the implementation and security analysis of websites utilizing HTTPS and SSL certificates, focusing on practical deployment challenges and risk factors. Through empirical evaluation, the research identifies common misconfigurations, assesses the impact of certificate quality and TLS settings on the attack surface, and formulates actionable recommendations for system administrators and developers. The findings highlight that while HTTPS adoption is widespread, gaps remain in certificate management, automation practices, and adherence to best configurations. By providing a catalog of observed issues and mitigation strategies, this work contributes to strengthening web security postures and offers practical guidance for medium-scale operators who have yet to fully leverage automated certificate solutions.

Network Forensics of Contact Forms BazarLoader and Cobalt Strike Based on PCAP File Analysis Rasendriya Khansa Jolankarfyan; Ashish Jaisan
International Journal of Cyber Engineering Jil. 1 No. 1 (2025): International Journal of Cyber Engineering - December Edition
Publisher : PT Baramedia Literasi Digital

Show Abstract | Download Original | Original Source | Check in Google Scholar | DOI: 10.68404/ijce.v1i1.8

This study presents a forensic analysis of the PCAP file 2021-12-03-Contact-Forms-BazarLoader-with-Cobalt-Strike to identify Indicators of Compromise (IoCs) and attack patterns associated with the BazarLoader malware family. Using Wireshark for packet inspection and VirusTotal for threat intelligence validation, several critical findings were observed. First, suspicious communication was detected with the domain mordister.top, flagged as malicious by 4 out of 97 security vendors. Second, evidence of Server Message Block (SMB) activity on port 445 indicated potential lateral movement within the network. Third, beaconing patterns were identified toward a Command and Control (C2) server via port 443, leveraging encrypted traffic to evade detection. These artifacts highlight the multi-stage nature of the infection chain, where BazarLoader facilitates the deployment of Cobalt Strike as a post-exploitation tool. The results demonstrate that early detection of BazarLoader infections can be achieved through multi-layered forensic analysis, combining network traffic inspection with external threat intelligence sources. Accuracy testing of the proposed detection approach yielded a rate of 92%, underscoring its effectiveness in identifying malicious activity at an early stage. This research contributes to the broader field of network forensics by providing actionable IoCs and detection strategies that can be integrated into security operations centers (SOCs) to mitigate risks posed by advanced malware campaigns.

Network Forensic Analysis of a Hancitor–Cobalt Strike Incident: Application of the NIST Methodology jamaludin; Ridho Surya Kusuma; Ashish Jaisan
International Journal of Cyber Engineering Jil. 1 No. 1 (2025): International Journal of Cyber Engineering - December Edition
Publisher : PT Baramedia Literasi Digital

Show Abstract | Download Original | Original Source | Check in Google Scholar | DOI: 10.68404/ijce.v1i1.9

Cybersecurity incidents involving the Hancitor and Cobalt Strike malware have been increasing and pose a significant threat to the security of organizational information systems. This study aims to conduct a network forensic analysis of attacks that employ the combined use of Hancitor and Cobalt Strike by applying the methodology of the National Institute of Standards and Technology (NIST) SP 800-86. The research adopts a qualitative approach by implementing the four stages of the NIST framework, namely collection, examination, analysis, and reporting. Data were obtained through simulated attacks in a controlled environment using forensic tools such as Wireshark and NetworkMiner. The findings reveal an attack pattern that begins with the initial Hancitor infection delivered through a malicious Microsoft Office document, followed by command and control (C2) communication used to download and execute the Cobalt Strike payload. Network packet analysis successfully identified suspicious traffic characteristics, including Cobalt Strike beaconing and data exfiltration activities. This study concludes that the application of the NIST forensic methodology is effective in uncovering the stages of such attacks and can assist organizations in responding to similar incidents in the future. Furthermore, the research findings can serve as indicators of compromise (IoCs) to enhance early detection of attacks involving the combined use of Hancitor and Cobalt Strike.

Analysis of Async RAT Malware Infection through Network Communication Using Wireshark Prasetyo Mimboro; Mochammad Luthfi Rahmadi; Ashish Jaisan
International Journal of Cyber Engineering Jil. 1 No. 1 (2025): International Journal of Cyber Engineering - December Edition
Publisher : PT Baramedia Literasi Digital

Show Abstract | Download Original | Original Source | Check in Google Scholar | DOI: 10.68404/ijce.v1i1.10

This study investigates the infection process of the Async Remote Access Trojan (Async RAT) and demonstrates how its malicious activity can be identified through network traffic analysis using Wireshark. Async RAT is a remote access malware that enables adversaries to gain complete control over compromised systems. The case study utilizes PCAP files and infection artifacts obtained from malware-traffic-analysis.net to reconstruct the infection chain, beginning with the execution of a suspicious ISO file containing a WSF script and culminating in the malware’s communication with Command and Control (C2) servers. The findings reveal that Async RAT employs both HTTP and HTTPS protocols to retrieve payloads and maintain interaction with remote servers. Furthermore, Indicators of Compromise (IoCs)—including domains, IP addresses, and file hashes—were identified and validated to provide insight into the attack vector. This research contributes to the broader understanding of malware infection patterns and supports the development of effective detection and mitigation strategies in cybersecurity practice.

Title

Found 5 Documents
Search

Abstract

Abstract

Abstract

Abstract

Abstract

Title Search

Found 5 Documents Search

Abstract

Abstract

Abstract

Abstract

Abstract

Title

Found 5 Documents
Search