NetWork | ZeroBOX

Network Analysis

IP Address Status Action
162.241.216.53 Active Moloch
164.124.101.2 Active Moloch
185.228.233.17 Active Moloch
GET 404 http://gtr.antoinfer.com/JpYeaQ5AOcDY/rfyxDpNI3mO/iJ3ovqS5v_2B5H/8_2FstgmLGy8SiY5LMx0P/EituxAw_2F1OT_2F/X1ci3b8Sjr8wAo1/66YBaY_2FksW8vd5vo/TEXd_2B2W/D2pVfVv3mXhAGWXDPytU/12Zw2ncyKTiv3go_2Fg/foUK_2BpSlCsNRew7G6G_2/FjRnzaxKHNolO/9wMZxS2S/ZbdD3kRoyjRmPKx8evdOYQv/LsnlVH7KdN/N715k_2Fp9Cvil0Rl/1RuaOQ5a0KCi/XN4U0cOQy7B/XKxlW1nVTT4OQl/g_2BHBlRyEvp6KHlKz5TY/rB2xcCyiu0f_2/Fli_2F
REQUEST
RESPONSE
GET 404 http://app.bighomegl.at/2BX4usqR3CA_/2BGc5QtYAkk/5sQ6xMttRRkp2M/4e_2Bzb1wuuVdjXiLpFsr/WsqZJWNfhuYjSGsc/ideV2yEdm89knSR/K9gbcsE4Nafxh70syF/AFgpdwBcE/swkgenw1UzriUWCHteY_/2FJ1fxEg4WYRspNakt4/WsqnHSeo1RsAJxvNSqO_2B/KnTqsuw8WKdm1/RgI0C0Gy/VvsFdangS27BzKwMpW5lpaV/aiKt3hFrVz/_2FVaKCayP98D_2Fz/h_2BwIdo7MEP/4AsUgz2l7my/5pwDfQf2QeO339/g_2Fm3RUAzmV0QuWpfJeC/nSxN6eOQ/K
REQUEST
RESPONSE
GET 404 http://gtr.antoinfer.com/RkrrjybChQ/2EXR8TFwqFx6VGRuO/Z1QFUB4IXCZD/Qd1860UstEI/0FpsdG207nYgJY/fCRqHqVZJg9116Ab4KV_2/FhRpJqUDX6mgFqsW/Gdwx_2F_2BxnFaZ/Lq789C1khgtpGx93q_/2Fhqyr4hh/GqqD1e8CEJbEMhIvrCSE/M3EODhmOAJC2X81BGtu/YufOphUnysDzRsTNhJMaEZ/YU8IWtJVc5pQ_/2FwODAJ_/2FIdXFF2zb5me4s4pKIB8JV/1tU8xhNTMv/53smDsLaBrxX39Lz0/eXPOugZCaKtZ/0_2FbCMp4zF/oc0_2F2k2mX/pUKZxw
REQUEST
RESPONSE
GET 404 http://app.bighomegl.at/4E0ttg1gp_2Ftg4l1_2B/eWoaZ3c3FW95iKk417H/7xB7p1XLZlyeRkNPYn4CKT/J7muNdOXn6DxQ/ogzt4SJJ/GiRzl0CTb2sRT1GcnGWx_2B/5zRPscx2Yo/UlYLKtmtVbormrIIa/i98ki83IT3HK/7VbEyf0xeIm/AOmPHig3hq8uyi/r570yUoRqQ63LqrdYxqn1/tlGlFCDGGtgOANlU/wcwiSAfqxf_2FeM/8MyLGHvpPs9yFd_2FR/83vaIGBtT/N81Y9eyW0iXQcRmLwwPR/Me83RfWCGiivw4PiW2Y/fJVtnndZ/jQeTvlCOeJjw6/l
REQUEST
RESPONSE
GET 404 http://gtr.antoinfer.com/NfYGW6X8yzwJ/TmELLbBwdW8/83tNWrSsAj2oO4/3mzyhwtyvu9xtyhBWsmEB/jvXNrSaYUeg9877Z/YkmJwmj7sbSiAPM/wvOnCYU3mtanlAAWVF/lEOl7A3Bg/rUbUyj5LWePdqjlbaGUW/iSW2ckc2ykuZHBzXpot/akHudVkA_2Fm_2Bq9if8ml/0wuZHIUOvWQk8/o4RWoGKb/KPtvXi6uRZ0s9YIobMM3iAx/mxuUhe9l8v/Zl4W6Dbg77k9Iw6Rk/bxaLW1uBN21L/4huFTLcw0rY/FfYqgoZ5_2BQXz/dzZVMlvJz6FcKlA/2o7a_2B
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49162 -> 162.241.216.53:443 2028375 ET JA3 Hash - Possible Malware - Java Based RAT Unknown Traffic
TCP 192.168.56.102:49165 -> 185.228.233.17:80 2033203 ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B) Malware Command and Control Activity Detected
TCP 192.168.56.102:49166 -> 185.228.233.17:80 2033203 ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B) Malware Command and Control Activity Detected
TCP 192.168.56.102:49165 -> 185.228.233.17:80 2033204 ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F) Malware Command and Control Activity Detected
TCP 192.168.56.102:49166 -> 185.228.233.17:80 2033204 ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F) Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 185.228.233.17:80 2033204 ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F) Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 185.228.233.17:80 2033203 ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B) Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 185.228.233.17:80 2033204 ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F) Malware Command and Control Activity Detected
TCP 192.168.56.102:49169 -> 185.228.233.17:80 2033203 ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B) Malware Command and Control Activity Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.2
192.168.56.102:49162
162.241.216.53:443
C=US, O=Let's Encrypt, CN=R3 CN=data.green-iraq.com 32:13:a5:dc:f9:2e:54:7b:fc:57:ea:36:3c:5a:8a:9b:24:3b:5e:d6

Snort Alerts

No Snort Alerts