{"id":4633,"date":"2021-08-25T06:26:00","date_gmt":"2021-08-25T06:26:00","guid":{"rendered":"\/cybersecurity-blog\/?p=4633"},"modified":"2023-03-29T06:29:59","modified_gmt":"2023-03-29T06:29:59","slug":"analyzing-the-network-stream","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/analyzing-the-network-stream\/","title":{"rendered":"Analyzing the Network Stream\u00a0\u00a0"},"content":{"rendered":"\n<p><\/p>\n\n\n\n<p>Network stream analysis involves monitoring and examining the incoming and outgoing HTTP requests packet by packet. This helps you identify malware that might be trying to communicate with its control servers or spread to other devices.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">When to use network stream analysis?&nbsp;<\/h2>\n\n\n\n<p>This technique is handy when you suspect a malware infection but can&#8217;t quite pinpoint it. By analyzing network traffic, you can spot unusual patterns or connections.&nbsp;<\/p>\n\n\n\n<p>Network stream analysis also provides valuable insights into malware configuration: proxies, C2 addresses, how the malware packs and retrieves data.&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Figure out what data was stolen.<\/strong> Passwords, logins, cookies: you can track what information has left your system&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Track downloads. <\/strong>You can identify PE file downloads just by looking at the signatures.&nbsp;<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How to use the ANY.RUN network stream window&nbsp;<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>1<\/strong>. <strong>Viewing the packets\u00a0<\/strong>\u00a0<\/h3>\n\n\n\n<p>Locate the packet you need by using the &#8220;Network stream&#8221; pop-up window on the navigation panel. The window initially displays quick previews so you can quickly scroll through blocks of information.&nbsp;<\/p>\n\n\n\n<p>To examine packet details individually, just select the data you&#8217;re interested in. Expand a block by clicking the Show button or directly on the block to reveal the entire packet&#8217;s data.&nbsp;<\/p>\n\n\n\n<p>Received and sent packets are displayed in different colors: <strong>blue for received <\/strong>and <strong>green for sent<\/strong>.&nbsp;&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>2. Using highlighting<\/strong>&nbsp;<\/h3>\n\n\n\n<p>You can use highlighting to help you focus on important information.&nbsp;&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Printable characters such as letters, signs, and figures will be highlighted&nbsp;<\/li>\n\n\n\n<li>Control characters and others that have less priority will be slightly transparent&nbsp;<\/li>\n<\/ul>\n\n\n\n<p>If you hold a mouse over the HEX code snippet, its clear text equivalent will be highlighted at the same time.&nbsp;&nbsp;<\/p>\n\n\n\n<p>Highlighting kicks in automatically when you expand a packet. You can toggle it off at anytime with the \u201chiglight chars\u201d toggle.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1000\" height=\"522\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/03\/image.gif\" alt=\"ANY.RUN Network stream\" class=\"wp-image-4634\"\/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>3. Switch between HEX and Text formats<\/strong>&nbsp;<\/h3>\n\n\n\n<p>By default, the modal shows HEX data, but you can switch into text mode at any time. In this mode you can also expand packets.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>4. View packet details and download packets<\/strong>&nbsp;<\/h3>\n\n\n\n<p>The modal header shows the <strong>IPs, domain name<\/strong>, the <strong>number of sent, <\/strong>and the <strong>number of received packets<\/strong>.\u00a0<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"145\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/03\/image-11-1024x145.png\" alt=\"ANY.RUN Network stream\" class=\"wp-image-4640\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/03\/image-11-1024x145.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/03\/image-11-300x42.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/03\/image-11-768x109.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/03\/image-11-370x52.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/03\/image-11-270x38.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/03\/image-11-740x105.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/03\/image-11.png 1193w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>If you select a part of the HEX\/cleartext you can download just that part, or you can get the whole packet in binary format using the download button which is above each packet.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"164\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/03\/image-10-1024x164.png\" alt=\"ANY.RUN Network stream\" class=\"wp-image-4636\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/03\/image-10-1024x164.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/03\/image-10-300x48.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/03\/image-10-768x123.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/03\/image-10-370x59.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/03\/image-10-270x43.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/03\/image-10-740x119.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/03\/image-10.png 1245w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>Network stream analysis involves monitoring and examining the incoming and outgoing HTTP requests packet by packet. This helps you identify malware that might be trying to communicate with its control servers or spread to other devices.&nbsp; When to use network stream analysis?&nbsp; This technique is handy when you suspect a malware infection but can&#8217;t quite [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":4099,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[57,10,54],"class_list":["post-4633","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-instructions","tag-anyrun","tag-cybersecurity","tag-features"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.10 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Analyzing the Network Stream\u00a0\u00a0 - ANY.RUN&#039;s Cybersecurity Blog<\/title>\n<meta name=\"description\" content=\"Network stream analysis involves monitoring and examining the incoming and outgoing HTTP requests packet by packet. Check it in ANY.RUN\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/any.run\/cybersecurity-blog\/analyzing-the-network-stream\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"ANY.RUN\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/analyzing-the-network-stream\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/analyzing-the-network-stream\/\"},\"author\":{\"name\":\"ANY.RUN\",\"@id\":\"https:\/\/any.run\/\"},\"headline\":\"Analyzing the Network Stream\u00a0\u00a0\",\"datePublished\":\"2021-08-25T06:26:00+00:00\",\"dateModified\":\"2023-03-29T06:29:59+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/analyzing-the-network-stream\/\"},\"wordCount\":407,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/any.run\/\"},\"keywords\":[\"ANYRUN\",\"cybersecurity\",\"features\"],\"articleSection\":[\"Instructions on ANY.RUN\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/any.run\/cybersecurity-blog\/analyzing-the-network-stream\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/analyzing-the-network-stream\/\",\"url\":\"https:\/\/any.run\/cybersecurity-blog\/analyzing-the-network-stream\/\",\"name\":\"Analyzing the Network Stream\u00a0\u00a0 - ANY.RUN&#039;s Cybersecurity Blog\",\"isPartOf\":{\"@id\":\"https:\/\/any.run\/\"},\"datePublished\":\"2021-08-25T06:26:00+00:00\",\"dateModified\":\"2023-03-29T06:29:59+00:00\",\"description\":\"Network stream analysis involves monitoring and examining the incoming and outgoing HTTP requests packet by packet. Check it in ANY.RUN\",\"breadcrumb\":{\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/analyzing-the-network-stream\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/any.run\/cybersecurity-blog\/analyzing-the-network-stream\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/analyzing-the-network-stream\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/any.run\/cybersecurity-blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Instructions on ANY.RUN\",\"item\":\"https:\/\/any.run\/cybersecurity-blog\/category\/instructions\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Analyzing the Network Stream\u00a0\u00a0\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/any.run\/\",\"url\":\"https:\/\/any.run\/\",\"name\":\"ANY.RUN&#039;s Cybersecurity Blog\",\"description\":\"Cybersecurity Blog covers topics for experienced professionals as well as for those new to it.\",\"publisher\":{\"@id\":\"https:\/\/any.run\/\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/any.run\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/any.run\/\",\"name\":\"ANY.RUN\",\"url\":\"https:\/\/any.run\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/any.run\/\",\"url\":\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg\",\"contentUrl\":\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg\",\"width\":1,\"height\":1,\"caption\":\"ANY.RUN\"},\"image\":{\"@id\":\"https:\/\/any.run\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/www.any.run\/\",\"https:\/\/twitter.com\/anyrun_app\",\"https:\/\/www.linkedin.com\/company\/30692044\",\"https:\/\/www.youtube.com\/channel\/UCOgCPho7lzmH7m6fPNlukrQ\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/any.run\/\",\"name\":\"ANY.RUN\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/any.run\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/c4ce3a6c672056b4a8cd6b0110782215?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/c4ce3a6c672056b4a8cd6b0110782215?s=96&d=mm&r=g\",\"caption\":\"ANY.RUN\"},\"url\":\"https:\/\/any.run\/cybersecurity-blog\/author\/a-bespalova\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Analyzing the Network Stream\u00a0\u00a0 - ANY.RUN&#039;s Cybersecurity Blog","description":"Network stream analysis involves monitoring and examining the incoming and outgoing HTTP requests packet by packet. Check it in ANY.RUN","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/any.run\/cybersecurity-blog\/analyzing-the-network-stream\/","twitter_misc":{"Written by":"ANY.RUN","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/any.run\/cybersecurity-blog\/analyzing-the-network-stream\/#article","isPartOf":{"@id":"https:\/\/any.run\/cybersecurity-blog\/analyzing-the-network-stream\/"},"author":{"name":"ANY.RUN","@id":"https:\/\/any.run\/"},"headline":"Analyzing the Network Stream\u00a0\u00a0","datePublished":"2021-08-25T06:26:00+00:00","dateModified":"2023-03-29T06:29:59+00:00","mainEntityOfPage":{"@id":"https:\/\/any.run\/cybersecurity-blog\/analyzing-the-network-stream\/"},"wordCount":407,"commentCount":0,"publisher":{"@id":"https:\/\/any.run\/"},"keywords":["ANYRUN","cybersecurity","features"],"articleSection":["Instructions on ANY.RUN"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/any.run\/cybersecurity-blog\/analyzing-the-network-stream\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/any.run\/cybersecurity-blog\/analyzing-the-network-stream\/","url":"https:\/\/any.run\/cybersecurity-blog\/analyzing-the-network-stream\/","name":"Analyzing the Network Stream\u00a0\u00a0 - ANY.RUN&#039;s Cybersecurity Blog","isPartOf":{"@id":"https:\/\/any.run\/"},"datePublished":"2021-08-25T06:26:00+00:00","dateModified":"2023-03-29T06:29:59+00:00","description":"Network stream analysis involves monitoring and examining the incoming and outgoing HTTP requests packet by packet. Check it in ANY.RUN","breadcrumb":{"@id":"https:\/\/any.run\/cybersecurity-blog\/analyzing-the-network-stream\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/any.run\/cybersecurity-blog\/analyzing-the-network-stream\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/any.run\/cybersecurity-blog\/analyzing-the-network-stream\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/any.run\/cybersecurity-blog\/"},{"@type":"ListItem","position":2,"name":"Instructions on ANY.RUN","item":"https:\/\/any.run\/cybersecurity-blog\/category\/instructions\/"},{"@type":"ListItem","position":3,"name":"Analyzing the Network Stream\u00a0\u00a0"}]},{"@type":"WebSite","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/","name":"ANY.RUN&#039;s Cybersecurity Blog","description":"Cybersecurity Blog covers topics for experienced professionals as well as for those new to it.","publisher":{"@id":"https:\/\/any.run\/"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/any.run\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/any.run\/","name":"ANY.RUN","url":"https:\/\/any.run\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg","contentUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg","width":1,"height":1,"caption":"ANY.RUN"},"image":{"@id":"https:\/\/any.run\/"},"sameAs":["https:\/\/www.facebook.com\/www.any.run\/","https:\/\/twitter.com\/anyrun_app","https:\/\/www.linkedin.com\/company\/30692044","https:\/\/www.youtube.com\/channel\/UCOgCPho7lzmH7m6fPNlukrQ"]},{"@type":"Person","@id":"https:\/\/any.run\/","name":"ANY.RUN","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/any.run\/","url":"https:\/\/secure.gravatar.com\/avatar\/c4ce3a6c672056b4a8cd6b0110782215?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/c4ce3a6c672056b4a8cd6b0110782215?s=96&d=mm&r=g","caption":"ANY.RUN"},"url":"https:\/\/any.run\/cybersecurity-blog\/author\/a-bespalova\/"}]}},"_links":{"self":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/4633"}],"collection":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/comments?post=4633"}],"version-history":[{"count":2,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/4633\/revisions"}],"predecessor-version":[{"id":4641,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/4633\/revisions\/4641"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/media\/4099"}],"wp:attachment":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/media?parent=4633"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/categories?post=4633"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/tags?post=4633"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}