NetWork | ZeroBOX

Network Analysis

IP Address Status Action
172.217.25.14 Active Moloch
203.159.80.206 Active Moloch
Name Response Post-Analysis Lookup
No hosts contacted.
POST 200 http://203.159.80.206/6.jpg
REQUEST
RESPONSE
POST 200 http://203.159.80.206/1.jpg
REQUEST
RESPONSE
POST 200 http://203.159.80.206/2.jpg
REQUEST
RESPONSE
POST 200 http://203.159.80.206/3.jpg
REQUEST
RESPONSE
POST 200 http://203.159.80.206/4.jpg
REQUEST
RESPONSE
POST 200 http://203.159.80.206/5.jpg
REQUEST
RESPONSE
POST 200 http://203.159.80.206/7.jpg
REQUEST
RESPONSE
POST 200 http://203.159.80.206/main.php
REQUEST
RESPONSE
POST 200 http://203.159.80.206/
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49811 -> 203.159.80.206:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 203.159.80.206:80 -> 192.168.56.102:49811 2026537 ET HUNTING Suspicious EXE Download Content-Type image/jpeg Potential Corporate Privacy Violation
TCP 203.159.80.206:80 -> 192.168.56.102:49811 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.102:49811 -> 203.159.80.206:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 203.159.80.206:80 -> 192.168.56.102:49811 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.102:49811 -> 203.159.80.206:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 203.159.80.206:80 -> 192.168.56.102:49811 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.102:49811 -> 203.159.80.206:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.168.56.102:49811 -> 203.159.80.206:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.168.56.102:49811 -> 203.159.80.206:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.168.56.102:49811 -> 203.159.80.206:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.168.56.102:49811 -> 203.159.80.206:80 2029236 ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil Malware Command and Control Activity Detected
TCP 192.168.56.102:49811 -> 203.159.80.206:80 2029846 ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt) A Network Trojan was detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts