popup
NetWork | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Network Analysis

Download pcap
Hosts 5 DNS 0 TCP 4 UDP 9 HTTP(S) 2 ICMP 0 IRC 0 Suricata Snort
IP Address Status Action
103.66.72.217 Active Moloch
115.73.211.230 Active Moloch
117.54.250.246 Active Moloch
164.124.101.2 Active Moloch
181.176.161.143 Active Moloch
Name Response Post-Analysis Lookup
No hosts contacted.
GET 200 https://115.73.211.230/lib95/TEST22-PC_W617601.17CBB1F79387D3BF80BB1A2B3BA9BB75/5/kps/
REQUEST
: GET /lib95/TEST22-PC_W617601.17CBB1F79387D3BF80BB1A2B3BA9BB75/5/kps/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.76.0
Host: 115.73.211.230
RESPONSE
: HTTP/1.1 200 OK
Server: nginx/1.10.3
Date: Fri, 07 May 2021 02
Content-Type: application/octet-stream
Content-Length: 224
Connection: keep-alive
BODY 

            

        


    



        
            

    
        GET
        
        200
        https://117.54.250.246/lib95/TEST22-PC_W617601.17CBB1F79387D3BF80BB1A2B3BA9BB75/5/kps/
        
    
    


        

            

                
 REQUEST

                

                    
                    

	
			

				:
				GET /lib95/TEST22-PC_W617601.17CBB1F79387D3BF80BB1A2B3BA9BB75/5/kps/ HTTP/1.1
			

			

				Connection:
				 Keep-Alive
			

			

				User-Agent:
				 curl/7.76.0
			

			

				Host:
				 117.54.250.246
			

	


                

            

            

                
 RESPONSE

                

                    
                    

	
			

				:
				HTTP/1.1 200 OK
			

			

				Server:
				 nginx/1.10.3
			

			

				Date:
				 Fri, 07 May 2021 02
			

			

				Content-Type:
				 application/octet-stream
			

			

				Content-Length:
				 224
			

			

				Connection:
				 keep-alive
			

	


                

            

        


        

            

                 BODY
                
            

            

                

            

        


    



        
        
	




                            
ICMP traffic



No ICMP traffic performed.



                            
IRC traffic



No IRC requests performed.



                            
Suricata Alerts


    

        

            Flow
            SID
            Signature
            Category
        

        
        

            
                TCP
                192.168.56.101:49205 ->
                181.176.161.143:443
            
            2404307
            ET CNC Feodo Tracker Reported CnC Server group 8
            A Network Trojan was detected
        

        
        

            
                TCP
                192.168.56.101:49205 ->
                181.176.161.143:443
            
            2028401
            ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex
            Unknown Traffic
        

        
        

            
                TCP
                192.168.56.101:49203 ->
                115.73.211.230:443
            
            2028401
            ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex
            Unknown Traffic
        

        
        

            
                TCP
                192.168.56.101:49204 ->
                117.54.250.246:443
            
            2028401
            ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex
            Unknown Traffic
        

        
        

            
                TCP
                117.54.250.246:443 ->
                192.168.56.101:49204
            
            2011540
            ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)
            Not Suspicious Traffic
        

        
        

            
                TCP
                115.73.211.230:443 ->
                192.168.56.101:49203
            
            2011540
            ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)
            Not Suspicious Traffic
        

        
        

            
                TCP
                181.176.161.143:443 ->
                192.168.56.101:49206
            
            2029340
            ET INFO TLS Handshake Failure
            Potentially Bad Traffic
        

        
    




Suricata TLS


    

        

            Flow
            Issuer
            Subject
            Fingerprint
        

        
        

            
                TLSv1 

                192.168.56.101:49203 

                115.73.211.230:443
            		
            C=AU, ST=Some-State, O=Internet Widgits Pty Ltd
            C=AU, ST=Some-State, O=Internet Widgits Pty Ltd
            bb:48:e9:a1:55:37:8d:d3:de:c1:26:8f:7a:43:8c:19:5e:bb:da:25
        

        
        

            
                TLSv1 

                192.168.56.101:49204 

                117.54.250.246:443
            		
            C=AU, ST=Some-State, O=Internet Widgits Pty Ltd
            C=AU, ST=Some-State, O=Internet Widgits Pty Ltd
            bb:48:e9:a1:55:37:8d:d3:de:c1:26:8f:7a:43:8c:19:5e:bb:da:25
        

        
    





                            
Snort Alerts


    
No Snort Alerts