Lion Cipher Lab
Read FakeNet-NG output: DNS, HTTP, and the beaconing a sample reveals when it thinks it's online
- Digital Forensics & IR (DFIR)
- Intermediate
- ~40 min
- Free · no account required
Why it matters
When you detonate a real malware sample, the single most useful thing it can tell you is who it phones home to and how. But you cannot let live malware actually reach its command-and-control (C2) server — that would leak that you are watching, could pull down a real second-stage payload, and might attack others. The standard, safe answer is to SIMULATE the whole internet: a tool called FakeNet-NG answers every DNS lookup and every HTTP request the sample makes, so the malware believes it is online and reveals its entire network behaviour, yet not a single packet leaves your isolated lab. The…
What you'll learn
- reading FakeNet-NG's per-protocol console logging (DNS, HTTP) line by line
- extracting network IOCs: C2 domain, callback URL, URI path, User-Agent
- recognising a fixed beacon interval from repeated timestamps and what it means
- spotting DGA (domain generation algorithm) behaviour in a burst of random domains
- correlating DNS answers with HTTP requests to reconstruct the full callback story
- judgment: when a simulated network is the right analysis choice, and its limits
Steps in this lab
- What FakeNet-NG is, and why we fake the whole internet
- The isolated lab, in one paragraph (so you know this is safe)
- Your evidence: the FakeNet-NG capture
- Read the DNS lines: what name did it ask for, and why do they all resolve?
- Read the HTTP request: the callback URL and the tell-tale User-Agent
- Read the clock: the beacon interval, and what a beacon is
- Spot the DGA burst and the second-stage download
- Correlate DNS + HTTP into one story, and list the IOCs
- The judgment call: WHEN to simulate the network, and its limits