NetWork | ZeroBOX

Network Analysis

IP Address Status Action
172.67.188.154 Active Moloch
164.124.101.2 Active Moloch
184.168.131.241 Active Moloch
216.58.220.196 Active Moloch
34.102.136.180 Active Moloch
GET 200 https://www.google.com/
REQUEST
RESPONSE
GET 200 https://www.bing.com/
REQUEST
RESPONSE
GET 200 http://www.tiny-tobi.com/glgd/?k2MHoV=Tf3VOJhMPEKSFVG4lRUL1GzDFZ6CZBEdr5MR7bq2IBxaGKCn7xrLB1FW9dPQYXeSruzHPx7P&tXR=NZiHaP
REQUEST
RESPONSE
GET 403 http://www.southernedgewaterdesigns.com/glgd/?k2MHoV=LmTpLul+ArKV8Uwki1jSQCkGp6Aq6ai3+ySGBIz1ozwHhyIBPM/T1rbH77EFyn0FPiGQCryP&tXR=NZiHaP
REQUEST
RESPONSE
GET 301 http://www.startfortoday.com/glgd/?k2MHoV=0MHzMxpJH4rILertVw/6MkQ8XgJjg7Igm9BaWXqz5e9JsR+Gvn2wWzdV9N9x+I11yW/2pRBs&tXR=NZiHaP
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49201 -> 204.79.197.200:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49198 -> 216.58.220.196:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49205 -> 184.168.131.241:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49205 -> 184.168.131.241:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49205 -> 184.168.131.241:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49207 -> 184.168.131.241:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49207 -> 184.168.131.241:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49207 -> 184.168.131.241:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49201
204.79.197.200:443
C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 02 CN=www.bing.com e6:d6:8f:e4:5e:31:2c:7f:a5:1a:6c:d5:bb:5c:15:c6:54:47:bf:47
TLSv1
192.168.56.101:49198
216.58.220.196:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=www.google.com f8:ac:5b:8f:1a:ee:5d:6b:5e:bc:fc:68:93:41:16:36:29:f6:62:36

Snort Alerts

No Snort Alerts