NetWork | ZeroBOX

IP Address	Status	Action
158.69.144.71	Active	Moloch
162.241.194.204	Active	Moloch
162.241.2.234	Active	Moloch
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch
191.252.142.218	Active	Moloch
192.185.36.81	Active	Moloch
217.195.198.212	Active	Moloch
64.37.52.95	Active	Moloch
67.222.155.191	Active	Moloch
67.23.226.231	Active	Moloch
89.35.173.76	Active	Moloch

Name	Response	Post-Analysis Lookup
mahinur.nucleustechbd.com	A 67.222.155.191	67.222.155.191
fotounirii.ro	A 89.35.173.76	89.35.173.76
gamberinigianluca.com	A 64.37.52.95	64.37.52.95
specs2go.shawalzahid.com	A 158.69.144.71	158.69.144.71
abdul.yousufbaloch.com	A 192.185.36.81	192.185.36.81
armaenerji.com	A 217.195.198.212	217.195.198.212
lamiragereception.com.au	A 67.23.226.231	67.23.226.231
fuherpronn.org	A 162.241.194.204	162.241.194.204
plascom.ind.br	A 191.252.142.218	191.252.142.218
lojamusic.com.br	A 162.241.2.234	162.241.2.234

TCP Requests

UDP Requests

GET 404 https://armaenerji.com/UserFiles/site/enerji-kablolari/HES/tbqsCGNY.php

GET 404 https://plascom.ind.br/_img/parceiros/Ii2g4cYzKfaMLz7.php

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49827 -> 192.185.36.81:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49824 -> 162.241.194.204:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 162.241.194.204:443 -> 192.168.56.102:49825	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.185.36.81:443 -> 192.168.56.102:49829	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.102:49828 -> 192.185.36.81:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49843 -> 162.241.2.234:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49837 -> 191.252.142.218:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 67.222.155.191:443 -> 192.168.56.102:49833	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 158.69.144.71:443 -> 192.168.56.102:49815	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.102:49817 -> 64.37.52.95:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49818 -> 64.37.52.95:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49835 -> 217.195.198.212:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 162.241.2.234:443 -> 192.168.56.102:49844	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.102:49823 -> 162.241.194.204:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49813 -> 158.69.144.71:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49814 -> 158.69.144.71:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 64.37.52.95:443 -> 192.168.56.102:49819	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.102:49831 -> 67.222.155.191:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49832 -> 67.222.155.191:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49838 -> 89.35.173.76:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49839 -> 89.35.173.76:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 89.35.173.76:443 -> 192.168.56.102:49840	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.102:49842 -> 162.241.2.234:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49837 191.252.142.218:443	C=US, ST=TX, L=Houston, O=cPanel, Inc., CN=cPanel, Inc. Certification Authority	CN=plascom.ind.br	1f:e9:98:05:fa:19:00:c4:80:aa:f2:ac:9f:c1:3c:9f:e4:63:c1:90
TLSv1 192.168.56.102:49835 217.195.198.212:443	C=US, ST=TX, L=Houston, O=cPanel, Inc., CN=cPanel, Inc. Certification Authority	CN=armaenerji.com	ac:fa:ea:1f:67:61:cf:bb:ae:49:ae:ad:5f:2a:ad:cc:65:b3:c2:b4

Snort Alerts

No Snort Alerts