NetWork | ZeroBOX

Network Analysis

IP Address Status Action
164.124.101.2 Active Moloch
185.228.233.17 Active Moloch
GET 404 http://gtr.antoinfer.com/ilhhkVZtVJpYqpN_2BDOP/NOHLJTIsHn_2Bqpm/LhC0_2BobD4aF4k/aePrgKyX0ZqdTkNB1U/Gyfb0AP_2/BJCao5nvD3BCJMOWv_2F/8lh5d67w2Ox_2Fi9AID/5fdZa6mvv_2Fjc96r_2FuM/e2iaxDWQXiKg1/dLrAkngq/mkQEH5oDsC4lNIJ8wpglr0x/l3zrqOJCoD/tK6zsFOoGoJbKE1GE/TZ29VpTmXuUv/aazx8EUYsNP/g7MxJzr20_2FZ5/NNXfrS4qMD_2BzT61bZwg/B5Ukry2Ow3XgD7FD/lJjlppM0OgSDTB8/fgOuogo7fQ8c92kawd/g
REQUEST
RESPONSE
GET 404 http://gtr.antoinfer.com/ilhhkVZtVJpYqpN_2BDOP/NOHLJTIsHn_2Bqpm/LhC0_2BobD4aF4k/aePrgKyX0ZqdTkNB1U/Gyfb0AP_2/BJCao5nvD3BCJMOWv_2F/8lh5d67w2Ox_2Fi9AID/5fdZa6mvv_2Fjc96r_2FuM/e2iaxDWQXiKg1/dLrAkngq/mkQEH5oDsC4lNIJ8wpglr0x/l3zrqOJCoD/tK6zsFOoGoJbKE1GE/TZ29VpTmXuUv/aazx8EUYsNP/g7MxJzr20_2FZ5/NNXfrS4qMD_2BzT61bZwg/B5Ukry2Ow3XgD7FD/lJjlppM0OgSDTB8/fgOuogo7fQ8c92kawd/g
REQUEST
RESPONSE
GET 404 http://app.bighomegl.at/lBfvYxl5Lshl9at_2FO/RXyfXhebrRaoVwB_2FnLA7/ROc7KuB9J3QSq/1Dr5huVt/SFQ3cZinVB5wJtPwY2gcxsU/Rfwvw986_2/BIr0sztvK8qdsoABe/QUDSbtlCkN_2/F1MKjCx3yoM/8NwL9JT0GI4fXn/YZXLzoYgy4bc1JzqUMlRQ/bEv2_2FvF57IvDFL/05AGNk7WXdTdrmc/rh1jM3tWjnQ_2Fs30X/TDrqYo2Zf/0aqqtLXOpNotSbMzfn0n/FWTI_2BX68Lx9sUiBbN/2VSsBwXA0STqV8064kgA_2/BZGUSSgQStsaV/QOtuP4p_/2BJWyIacZlgDFTvZ1nw1ogV/bC8Sw
REQUEST
RESPONSE
GET 404 http://app.bighomegl.at/uWEvFb6RfbVReReaEa5z_2F/AYPFSuVCGL/BUr96O06vWM79Tp_2/FFh1vOdPwdTC/h0yJai59TuO/n6bSyUvzZcfY14/B2kuCIra_2B2ccpEshCI_/2B0JgWvBGAM9V59u/QSjBoCRdUyjufXs/_2BuwbUspt5tUlp2wX/D_2F8nrCj/Hj9jlKAVBEcTi5Ix_2Fi/vzo5PxBPbqm3RWtGn3P/gefVzlX7EtGEzG7mpadkfd/3MLXWAIzLDIeu/AlKOxni_/2ButUcbP9uBh3GTD0pgdDfi/Y_2B9LQya8/GCjx2odmZYR_2FdVm/9Op2ntnJJ7AV/tpN7pejv/x
REQUEST
RESPONSE
GET 404 http://gtr.antoinfer.com/CElNOIv6Dq/1o4yaoj90B_2FOYQk/j_2BOfLBbEYu/Dg_2BYo8RD2/VW58yPHueGQ5rG/Xu1MCjXvALwg3mUEnG5hI/ptpUEQH8ZNM8sTJY/5rMWXDt6O92qkSe/uyxO0XWsWJiDEXwSFn/t2e9Oxnfi/wXpSxp7VYe2ZFmtM938P/jSJM129e_2FrYdtwCJi/JtyhtGqaQMdW4w_2BCmeQW/8lLyrSNoGhhHo/VhQGtN6j/_2B86XMH3MMlbpdOl4nSV1Z/W4NfJE29XL/jpYyaeNs7AfD9KMuB/ji00M8SpkHOo/P374Yj_2BZq/fcXezeIHxJmDH7_2/B
REQUEST
RESPONSE
GET 404 http://gtr.antoinfer.com/3lxXBVpX/37GSsDJacyaps9UTuAj4dXU/bhJs1AOFEq/v48Fs5fyxtNfSPnvl/GI_2BAaIQ1Td/HLKcBYEwJZ0/zjYZ_2BbcGIz6y/lSSW5zBgIwkHYVcLGVOnG/vuCSAHezIRJ4V8ow/vPs162wVtqxAqrN/yFJnULwSdpzOdZ5asP/fjCO0uwl5/j0BXUOKuRNhtgR_2Bqr2/Dsf8_2F2VwUEDM3ZZAB/6Hjf8SoH_2B0_2BJ3cUtlt/tVaKrbu2ABUd3/LQtxfXkh/mtogAmoKkVJD3k3A4T_2F2w/eS2i_2BNQw/alze_2BQtU8PiyWIb/MShw4aRT5I/p
REQUEST
RESPONSE
GET 404 http://app.bighomegl.at/2HHWI5LnqgR_2BV/mi5nknbAuhcRKM_2BV/V8mC_2BsB/NolNIFNRaGA1zPdDCTn2/pR1jx5PUmSU7xYBfraW/tIzrh4tzh_2FwuS05hfFYm/u4NKnM_2FflZk/L4vFSglc/8_2BzUXR4_2FpT7_2FQqdRO/Kzomixh0dq/U32GTU1UlVUGxBubq/zEDWT7buQosJ/1WXNlsvDtjB/T4NAmRQjuq_2F9/LIQMElMv3o050p2ZYWB9_/2BiUVa0S90i_2BJH/CA7es6Ste2BF6bt/eudo_2B7u6DSMZ_2F3/zdxRBIoil/Cv73PMdBdEphlbvmWXND/CWiX66C0AjF/HAIp
REQUEST
RESPONSE
GET 404 http://app.bighomegl.at/2HHWI5LnqgR_2BV/mi5nknbAuhcRKM_2BV/V8mC_2BsB/NolNIFNRaGA1zPdDCTn2/pR1jx5PUmSU7xYBfraW/tIzrh4tzh_2FwuS05hfFYm/u4NKnM_2FflZk/L4vFSglc/8_2BzUXR4_2FpT7_2FQqdRO/Kzomixh0dq/U32GTU1UlVUGxBubq/zEDWT7buQosJ/1WXNlsvDtjB/T4NAmRQjuq_2F9/LIQMElMv3o050p2ZYWB9_/2BiUVa0S90i_2BJH/CA7es6Ste2BF6bt/eudo_2B7u6DSMZ_2F3/zdxRBIoil/Cv73PMdBdEphlbvmWXND/CWiX66C0AjF/HAIp
REQUEST
RESPONSE
GET 404 http://gtr.antoinfer.com/siE06Vq3G3JE5ObEka0k/tpwdKD_2B3K3GaDDnwk/RbNemIwnYrQzvBRpf15bD5/Z408V5zjfgb2M/ZgJDjcnk/sMVAXyjXUqFReFnLGRvFWZr/e4_2Frdm_2/BWpN5_2BDC9y4fogx/kmMjucyW2OAA/MxohON3Kmgq/RKgNKOwW8WymyS/7UvCoW0NxhlEp41phcEe8/Mls8DN1q99WP1L_2/BoDZxnIqiZBVBum/fB2t2g5WMzBFPBBb61/yuZ3QJYaS/thERMjJwZRQiMezRQ1By/t5ovvExGL4VXh0QtLY9/cYr8RSU8sCVV9PX5JUX0Uw/pHa8qwHU/s72xVKtMolQq/C
REQUEST
RESPONSE
GET 404 http://gtr.antoinfer.com/1JiyJgiW_2BzuXCBKF/HfwkH43OC/P_2B2ZbYWqUMnJ4eh8oV/lfB5Fep_2BVSFAukmne/822eeAeBOoroCj2RR3_2FI/VSJM9wl266h1n/sEo0nK2I/oKp8oRfjuH9eZaOMAwylLtc/XgXOrJfG6l/c6hoOLP2Bv3ZN3w3b/c5R7Bng5Dn93/QCvHGckIYgu/dHOA2vY4p_2F7u/ezoibGfKXqlgng8DyUBhG/WN0DmTjbiDMhb9E4/t4yOcRaNAhbjdhK/ZjQwNg4KN6JsI7zq7Y/bIflTY_2B/3w0tKs28cEXSzGjB4ZD_/2Fjkap9RkXGFIlOQr16/ucz8o2dCUOW_2F_2F19_2B/9EXN
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49209 -> 185.228.233.17:80 2033204 ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 185.228.233.17:80 2033203 ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 185.228.233.17:80 2033204 ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F) Malware Command and Control Activity Detected
TCP 192.168.56.101:49207 -> 185.228.233.17:80 2033203 ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B) Malware Command and Control Activity Detected
TCP 192.168.56.101:49207 -> 185.228.233.17:80 2033204 ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F) Malware Command and Control Activity Detected
TCP 192.168.56.101:49216 -> 185.228.233.17:80 2033203 ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B) Malware Command and Control Activity Detected
TCP 192.168.56.101:49216 -> 185.228.233.17:80 2033204 ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F) Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 185.228.233.17:80 2033203 ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 185.228.233.17:80 2033203 ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 185.228.233.17:80 2033204 ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F) Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 185.228.233.17:80 2033203 ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B) Malware Command and Control Activity Detected
TCP 192.168.56.101:49218 -> 185.228.233.17:80 2033203 ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B) Malware Command and Control Activity Detected
TCP 192.168.56.101:49218 -> 185.228.233.17:80 2033204 ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F) Malware Command and Control Activity Detected
TCP 192.168.56.101:49215 -> 185.228.233.17:80 2033203 ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B) Malware Command and Control Activity Detected
TCP 192.168.56.101:49215 -> 185.228.233.17:80 2033204 ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F) Malware Command and Control Activity Detected
TCP 192.168.56.101:49217 -> 185.228.233.17:80 2033203 ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts