NetWork | ZeroBOX

Flow	SID	Signature	Category
UDP 192.168.56.102:57660 -> 164.124.101.2:53	2026888	ET INFO DNS Query for Suspicious .icu Domain	Potentially Bad Traffic
TCP 192.168.56.102:49811 -> 45.15.143.157:80	2010067	ET POLICY Data POST to an image file (jpg)	A Network Trojan was detected
TCP 192.168.56.102:49811 -> 45.15.143.157:80	2026887	ET INFO HTTP POST Request to Suspicious *.icu domain	Potentially Bad Traffic
TCP 45.15.143.157:80 -> 192.168.56.102:49811	2026537	ET HUNTING Suspicious EXE Download Content-Type image/jpeg	Potential Corporate Privacy Violation
TCP 45.15.143.157:80 -> 192.168.56.102:49811	2023464	ET HUNTING Possible EXE Download From Suspicious TLD	Misc activity
TCP 192.168.56.102:49811 -> 45.15.143.157:80	2010067	ET POLICY Data POST to an image file (jpg)	A Network Trojan was detected
TCP 192.168.56.102:49811 -> 45.15.143.157:80	2026887	ET INFO HTTP POST Request to Suspicious *.icu domain	Potentially Bad Traffic
TCP 45.15.143.157:80 -> 192.168.56.102:49811	2023464	ET HUNTING Possible EXE Download From Suspicious TLD	Misc activity
TCP 192.168.56.102:49811 -> 45.15.143.157:80	2010067	ET POLICY Data POST to an image file (jpg)	A Network Trojan was detected
TCP 192.168.56.102:49811 -> 45.15.143.157:80	2026887	ET INFO HTTP POST Request to Suspicious *.icu domain	Potentially Bad Traffic
TCP 45.15.143.157:80 -> 192.168.56.102:49811	2023464	ET HUNTING Possible EXE Download From Suspicious TLD	Misc activity
TCP 192.168.56.102:49811 -> 45.15.143.157:80	2010067	ET POLICY Data POST to an image file (jpg)	A Network Trojan was detected
TCP 192.168.56.102:49811 -> 45.15.143.157:80	2026887	ET INFO HTTP POST Request to Suspicious *.icu domain	Potentially Bad Traffic
TCP 192.168.56.102:49811 -> 45.15.143.157:80	2010067	ET POLICY Data POST to an image file (jpg)	A Network Trojan was detected
TCP 192.168.56.102:49811 -> 45.15.143.157:80	2026887	ET INFO HTTP POST Request to Suspicious *.icu domain	Potentially Bad Traffic
TCP 192.168.56.102:49811 -> 45.15.143.157:80	2010067	ET POLICY Data POST to an image file (jpg)	A Network Trojan was detected
TCP 192.168.56.102:49811 -> 45.15.143.157:80	2026887	ET INFO HTTP POST Request to Suspicious *.icu domain	Potentially Bad Traffic
TCP 192.168.56.102:49811 -> 45.15.143.157:80	2010067	ET POLICY Data POST to an image file (jpg)	A Network Trojan was detected
TCP 192.168.56.102:49811 -> 45.15.143.157:80	2026887	ET INFO HTTP POST Request to Suspicious *.icu domain	Potentially Bad Traffic
TCP 192.168.56.102:49811 -> 45.15.143.157:80	2026887	ET INFO HTTP POST Request to Suspicious *.icu domain	Potentially Bad Traffic
TCP 192.168.56.102:49811 -> 45.15.143.157:80	2026887	ET INFO HTTP POST Request to Suspicious *.icu domain	Potentially Bad Traffic
TCP 192.168.56.102:49811 -> 45.15.143.157:80	2029236	ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil	Malware Command and Control Activity Detected
TCP 192.168.56.102:49811 -> 45.15.143.157:80	2029846	ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)	A Network Trojan was detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts