◆ Packet captures

Malware-Traffic-Analysis.net

license: see source

PCAPs of real malware infections with write-ups and indicators, published continuously since 2013. Archives are password-protected.

Summary

From the project’s own instructions where it documents any; otherwise a plain clone.

Download from malware-traffic-analysis.net ↗
Start from the source page, or use the commands below.

shell

$ curl -LO https://www.malware-traffic-analysis.net/2025/12/30/2025-12-30-Lumma-Stealer-infection-with-other-malware.pcap.zip

A Lumma Stealer infection with follow-up malware (about 18 MB).

shell
```
$ curl -LO https://www.malware-traffic-analysis.net/2025/12/29/2025-12-29-ClickFix-page-sends-NetSupportRAT.pcap.zip
```
A ClickFix page delivering NetSupport RAT. The zip password scheme is on the site's About page. The traffic carries real malware payloads, so unzip it inside an analysis VM; antivirus will flag it.

Commands are curated, not yet run by us.

Suricata — Replay the capture through your ruleset and write eve.json to out/.

sample.pcap

$ suricata -r sample.pcap -l out/

Zeek — Parse the capture offline; Zeek writes conn.log, dns.log, http.log and friends to the current directory.

sample.pcap

$ zeek -r sample.pcap

Wireshark — Print a one-line summary per packet with tshark, Wireshark's command-line reader.

sample.pcap

$ tshark -r sample.pcap

Snort3 — Read the capture with your Snort 3 configuration and print alerts to the console.

sample.pcap

$ snort -c /usr/local/etc/snort/snort.lua -r sample.pcap -A alert_fast