Hello all,
According to the Wireshark record my computer connects to various services often, including Amazon, Hetzner, 1337 Services GmbH, Evanzo GmbH and ThomasFamilyInvestments. The most often were the connections to mail.my-mail.rocks which is a part of Netcup GmbH. I have a somewhat minimal distro and the attached recordings were made when no app was open including no browser. I can send the other screenshots showing other connections too. I'm suspecting of malware since some time ago but can you help me clarify these connections please?
I can’t see that link. Just drop the log in a paste bin or something.
You’re probably not in a position to figure out what the malware is doing, or even if you have malware running.
If you brought me your computer and said “I think I have malware and I want to understand what’s happening” I would remove the drive, image it using an appliance instead of a computer and put the image in a forensic environment so I could observe it safely.
I wish I could bring it to an expert. Do you know how to find one? Here is the file: https://paste.centos.org/view/5df16fbe Sorry for the delay