/usr/local/zeek/share/zeek/site/local.zeek

root@53ef41d5da39:/usr/local/zeek/share/zeek# find . | grep extract
./base/files/extract
./base/files/extract/main.zeek
./base/files/extract/__load__.zeek
./policy/protocols/http/var-extraction-uri.zeek
./policy/protocols/http/var-extraction-cookies.zeek
./policy/frameworks/intel/seen/smtp-url-extraction.zeek
./policy/frameworks/files/extract-all-files.zeek
./policy/tuning/defaults/extracted_file_limits.zeek

Copy

added this line to local.zeek

also copied local.zeek to custom.zeek

cp local.zeek custom.zeek
Copy

zeek -C -r Capture.pcap custom
Copy

now we have folder -> extract_files

cat http.log | zeek-grep Wget | less -S
Copy

ls extract_files/ | grep FM4a5p1MGD3XkvhPU7

extract-1679398954.413587-HTTP-FM4a5p1MGD3XkvhPU7

Copy

the file was 100M, may thats the reason my unzip failed

but running 7z l on the file i was able to get the ransomeware name ->
gonnacry

7z l extract-1679398954.413587-HTTP-FM4a5p1MGD3XkvhPU7
Copy

cat ftp.log  | zeek-grep RETR| zeek-cut command arg fuid
Copy