NetWork | ZeroBOX

Network Analysis

IP Address Status Action
172.67.188.154 Active Moloch
164.124.101.2 Active Moloch
172.217.161.132 Active Moloch
172.67.213.238 Active Moloch
34.102.136.180 Active Moloch
GET 200 https://www.google.com/
REQUEST
RESPONSE
GET 200 https://www.bing.com/
REQUEST
RESPONSE
GET 301 http://www.sortporn.com/glgd/?RP=k4vCTHC2Fy64mjnc2OnjE9lfpfcWP7zm1g/wpAjuywoYf+NJr/Q2F7wIL3Xl1tElCz0dJ3I0&rVLp7B=S0D0v6m
REQUEST
RESPONSE
GET 403 http://www.theheilene.com/glgd/?RP=ttmJ8xUlGddbSXz60THSMTPfyyvYSvlCEYe6Jjlb6mDS53794vvP5xg1R5GSNSWJBJziZCVC&rVLp7B=S0D0v6m
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49167 -> 172.217.161.132:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49169 -> 204.79.197.200:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49172 -> 172.67.213.238:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 172.67.213.238:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 172.67.213.238:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49173 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49173 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49173 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49167
172.217.161.132:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=www.google.com c8:9c:3b:ae:6d:9b:08:bf:ce:0e:db:91:a5:77:47:52:ec:41:f4:a5
TLSv1
192.168.56.102:49169
204.79.197.200:443
C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 02 CN=www.bing.com e6:d6:8f:e4:5e:31:2c:7f:a5:1a:6c:d5:bb:5c:15:c6:54:47:bf:47

Snort Alerts

No Snort Alerts