A vulnerability research team has detected a new variant of a stealth Trojan that disables itself when it detects that it is running on a virtualized environment. The team decides to use dedicated…

A Host-based IDS (HIDS) monitors system calls, file integrity, and log events on the host but does not produce the granular, full-packet network captures needed to extract specific DNS names and IPs from malware traffic.

A vulnerability scanner probes target hosts for known weaknesses and does not observe or record live network communications generated by executing malware.

A packet analyzer such as Wireshark captures all network frames on the isolated hardware segment in real time. After the Trojan decrypts its payload and begins communicating, the packet analyzer records every DNS resolution request and TCP/UDP connection, revealing the exact domain names and IP addresses of any command-and-control infrastructure the malware contacts.

Firewall logs record connection attempts at a high level and may omit DNS query details or internal traffic, lacking the full packet payload needed for complete C2 infrastructure identification.

A disassembler statically analyzes binary code to understand program logic but cannot show the actual run-time DNS resolutions and IP connections that only occur after the payload decrypts dynamically.