popup
NetWork | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Network Analysis

Download pcap
Hosts 2 DNS 1 TCP 1 UDP 10 HTTP 0 ICMP 0 IRC 0 Suricata Snort
IP Address Status Action
164.124.101.2 Active Moloch
213.152.161.117 Active Moloch
Name Response Post-Analysis Lookup
storage.nsupdate.info
A 213.152.161.117
213.152.161.117

No traffic

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49209 -> 213.152.161.117:8973 906200098 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (BitRAT) undefined
TCP 213.152.161.117:8973 -> 192.168.56.101:49209 2030724 ET MALWARE Observed Malicious SSL Cert (BitRAT CnC) Domain Observed Used for C2 Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.2
192.168.56.101:49209
213.152.161.117:8973 		CN=BitRAT CN=BitRAT 5d:ba:98:0c:67:3f:12:24:cc:f2:a1:1e:42:7a:2c:ca:af:13:9f:26

Snort Alerts

No Snort Alerts