NetWork | ZeroBOX

Network Analysis

IP Address Status Action
13.58.168.69 Active Moloch
164.124.101.2 Active Moloch
167.114.6.154 Active Moloch
216.58.220.196 Active Moloch
34.102.136.180 Active Moloch
87.98.230.60 Active Moloch
GET 200 https://www.google.com/
REQUEST
RESPONSE
GET 200 https://www.bing.com/
REQUEST
RESPONSE
GET 404 http://www.soilhelp.com/glgd/?RR=asBy0YopPjG4dHaqcidLxAgpRjeYKvHFAx/LEx9W68MuHxQADtJpsJBj24UwIzZQ8AGX6ju+&sPX4gJ=lnRlMNFPWfi0
REQUEST
RESPONSE
GET 403 http://www.farendofthebench.com/glgd/?RR=svcqGWQO7MOM0XfFk+NDKL2Ww32z3qceQtZ1u2oY7ETYeE8QmVUYaDfZDsJbMwTSbwYX1aU8&sPX4gJ=lnRlMNFPWfi0
REQUEST
RESPONSE
GET 502 http://www.sabortradicion.com/glgd/?RR=RWZUdDZM2vWJGNyKWyakMM1rPTQtzSNU3Jzm3LUz16xspXtvwrI+PBSJlVTsPv0xAjpy10DH&sPX4gJ=lnRlMNFPWfi0
REQUEST
RESPONSE
GET 301 http://www.danielsdonuteria.com/glgd/?RR=IpIqRkOeyywi3K8x4XdnqdH9Qx+aXhYHwHTGsqzrpTB78CdxIABDUEXezTmookMwz0BXydeD&sPX4gJ=lnRlMNFPWfi0
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49199 -> 204.79.197.200:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49197 -> 216.58.220.196:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49205 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49205 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49205 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 13.58.168.69:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 13.58.168.69:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 13.58.168.69:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49207 -> 167.114.6.154:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49207 -> 167.114.6.154:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49207 -> 167.114.6.154:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 87.98.230.60:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 87.98.230.60:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 87.98.230.60:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49199
204.79.197.200:443
C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 02 CN=www.bing.com e6:d6:8f:e4:5e:31:2c:7f:a5:1a:6c:d5:bb:5c:15:c6:54:47:bf:47
TLSv1
192.168.56.101:49197
216.58.220.196:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=www.google.com f8:ac:5b:8f:1a:ee:5d:6b:5e:bc:fc:68:93:41:16:36:29:f6:62:36

Snort Alerts

No Snort Alerts