popup
NetWork | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Network Analysis

Download pcap
Hosts 3 DNS 2 TCP 1 UDP 15 HTTP 0 ICMP 8 IRC 0 Suricata Snort
IP Address Status Action
164.124.101.2 Active Moloch
194.5.97.107 Active Moloch
204.79.197.200 Active Moloch

No traffic

ICMP traffic

Source Destination ICMP Type Data
192.168.56.102 204.79.197.200 8 abcdefghijklmnopqrstuvwabcdefghi
204.79.197.200 192.168.56.102 0 abcdefghijklmnopqrstuvwabcdefghi
192.168.56.102 204.79.197.200 8 abcdefghijklmnopqrstuvwabcdefghi
204.79.197.200 192.168.56.102 0 abcdefghijklmnopqrstuvwabcdefghi
192.168.56.102 204.79.197.200 8 abcdefghijklmnopqrstuvwabcdefghi
204.79.197.200 192.168.56.102 0 abcdefghijklmnopqrstuvwabcdefghi
192.168.56.102 204.79.197.200 8 abcdefghijklmnopqrstuvwabcdefghi
204.79.197.200 192.168.56.102 0 abcdefghijklmnopqrstuvwabcdefghi

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49171 -> 194.5.97.107:8921 906200098 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (BitRAT) undefined
TCP 194.5.97.107:8921 -> 192.168.56.102:49171 2030724 ET MALWARE Observed Malicious SSL Cert (BitRAT CnC) Domain Observed Used for C2 Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.2
192.168.56.102:49171
194.5.97.107:8921 		CN=BitRAT CN=BitRAT be:1b:5d:99:44:90:0f:eb:08:13:79:0b:f5:04:c7:0a:d2:ca:97:e8

Snort Alerts

No Snort Alerts