NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.21.14.15 Active Moloch
164.124.101.2 Active Moloch
172.67.133.191 Active Moloch
45.133.1.27 Active Moloch
GET 301 https://www.yoursite.com/
REQUEST
RESPONSE
GET 200 https://yoursite.com/
REQUEST
RESPONSE
POST 200 http://vtqt.xyz/6.jpg
REQUEST
RESPONSE
POST 200 http://vtqt.xyz/1.jpg
REQUEST
RESPONSE
POST 200 http://vtqt.xyz/2.jpg
REQUEST
RESPONSE
POST 200 http://vtqt.xyz/3.jpg
REQUEST
RESPONSE
POST 200 http://vtqt.xyz/4.jpg
REQUEST
RESPONSE
POST 200 http://vtqt.xyz/5.jpg
REQUEST
RESPONSE
POST 200 http://vtqt.xyz/7.jpg
REQUEST
RESPONSE
POST 200 http://vtqt.xyz/main.php
REQUEST
RESPONSE
POST 200 http://vtqt.xyz/
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49204 -> 104.21.14.15:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49208 -> 45.133.1.27:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 45.133.1.27:80 -> 192.168.56.101:49208 2026537 ET HUNTING Suspicious EXE Download Content-Type image/jpeg Potential Corporate Privacy Violation
TCP 192.168.56.101:49208 -> 45.133.1.27:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.168.56.101:49199 -> 172.67.133.191:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49208 -> 45.133.1.27:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.168.56.101:49208 -> 45.133.1.27:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.168.56.101:49208 -> 45.133.1.27:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.168.56.101:49208 -> 45.133.1.27:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.168.56.101:49208 -> 45.133.1.27:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.168.56.101:49208 -> 45.133.1.27:80 2027108 ET HUNTING Suspicious Zipped Filename in Outbound POST Request (screenshot.) M2 A Network Trojan was detected
TCP 192.168.56.101:49208 -> 45.133.1.27:80 2029236 ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 45.133.1.27:80 2029846 ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt) A Network Trojan was detected
TCP 192.168.56.101:49208 -> 45.133.1.27:80 2031189 ET HUNTING HTTP POST to XYZ TLD Containing Pass - Possible Phishing Misc activity

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49204
104.21.14.15:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 97:38:3d:17:60:cf:37:5f:32:f8:a8:d4:38:b0:95:2f:df:2d:6a:93
TLSv1
192.168.56.101:49199
172.67.133.191:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 97:38:3d:17:60:cf:37:5f:32:f8:a8:d4:38:b0:95:2f:df:2d:6a:93

Snort Alerts

No Snort Alerts