NetWork | ZeroBOX

Network Analysis

IP Address Status Action
172.67.188.154 Active Moloch
104.21.14.15 Active Moloch
164.124.101.2 Active Moloch
45.144.225.201 Active Moloch
GET 301 https://www.yoursite.com/
REQUEST
RESPONSE
GET 200 https://yoursite.com/
REQUEST
RESPONSE
POST 200 http://orisinlog.com/6.jpg
REQUEST
RESPONSE
POST 200 http://orisinlog.com/1.jpg
REQUEST
RESPONSE
POST 200 http://orisinlog.com/2.jpg
REQUEST
RESPONSE
POST 200 http://orisinlog.com/3.jpg
REQUEST
RESPONSE
POST 200 http://orisinlog.com/4.jpg
REQUEST
RESPONSE
POST 200 http://orisinlog.com/5.jpg
REQUEST
RESPONSE
POST 200 http://orisinlog.com/7.jpg
REQUEST
RESPONSE
POST 200 http://orisinlog.com/main.php
REQUEST
RESPONSE
POST 200 http://orisinlog.com/
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49200 -> 104.21.14.15:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49206 -> 45.144.225.201:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 45.144.225.201:80 -> 192.168.56.101:49206 2026537 ET HUNTING Suspicious EXE Download Content-Type image/jpeg Potential Corporate Privacy Violation
TCP 192.168.56.101:49197 -> 104.21.14.15:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49206 -> 45.144.225.201:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.168.56.101:49206 -> 45.144.225.201:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.168.56.101:49206 -> 45.144.225.201:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.168.56.101:49206 -> 45.144.225.201:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.168.56.101:49206 -> 45.144.225.201:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.168.56.101:49206 -> 45.144.225.201:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.168.56.101:49206 -> 45.144.225.201:80 2027108 ET HUNTING Suspicious Zipped Filename in Outbound POST Request (screenshot.) M2 A Network Trojan was detected
TCP 192.168.56.101:49206 -> 45.144.225.201:80 2029236 ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 45.144.225.201:80 2029846 ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt) A Network Trojan was detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49200
104.21.14.15:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 97:38:3d:17:60:cf:37:5f:32:f8:a8:d4:38:b0:95:2f:df:2d:6a:93
TLSv1
192.168.56.101:49197
104.21.14.15:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 97:38:3d:17:60:cf:37:5f:32:f8:a8:d4:38:b0:95:2f:df:2d:6a:93

Snort Alerts

No Snort Alerts