NetWork | ZeroBOX

Network Analysis

IP Address Status Action
164.124.101.2 Active Moloch
185.163.45.248 Active Moloch
185.215.113.77 Active Moloch
195.201.225.248 Active Moloch
GET 200 https://telete.in/brikitiki
REQUEST
RESPONSE
POST 200 http://185.163.45.248/
REQUEST
RESPONSE
GET 200 http://185.163.45.248//l/f/VAuJUXsBPvGyIjkLtOpJ/d657180f13db0ff9b8ee6da6bdfe300a7ea52ed9
REQUEST
RESPONSE
GET 200 http://185.163.45.248//l/f/VAuJUXsBPvGyIjkLtOpJ/cd7c869b70884aeb0988dc2ac3b497411564fd4d
REQUEST
RESPONSE
POST 200 http://myproskxa.ac.ug/index.php
REQUEST
RESPONSE
POST 200 http://185.163.45.248/
REQUEST
RESPONSE
POST 200 http://kullasa.ac.ug/softokn3.dll
REQUEST
RESPONSE
POST 200 http://kullasa.ac.ug/sqlite3.dll
REQUEST
RESPONSE
POST 200 http://kullasa.ac.ug/freebl3.dll
REQUEST
RESPONSE
POST 200 http://kullasa.ac.ug/mozglue.dll
REQUEST
RESPONSE
POST 200 http://kullasa.ac.ug/msvcp140.dll
REQUEST
RESPONSE
POST 200 http://kullasa.ac.ug/nss3.dll
REQUEST
RESPONSE
POST 200 http://kullasa.ac.ug/vcruntime140.dll
REQUEST
RESPONSE
POST 200 http://kullasa.ac.ug/main.php
REQUEST
RESPONSE
POST 200 http://kullasa.ac.ug/
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49205 -> 195.201.225.248:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 185.163.45.248:80 -> 192.168.56.101:49206 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 185.163.45.248:80 -> 192.168.56.101:49206 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 185.163.45.248:80 -> 192.168.56.101:49206 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 185.215.113.77:80 -> 192.168.56.101:49217 2400024 ET DROP Spamhaus DROP Listed Traffic Inbound group 25 Misc Attack
TCP 185.215.113.77:80 -> 192.168.56.101:49283 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 192.168.56.101:49283 -> 185.215.113.77:80 2027108 ET HUNTING Suspicious Zipped Filename in Outbound POST Request (screenshot.) M2 A Network Trojan was detected
TCP 192.168.56.101:49283 -> 185.215.113.77:80 2029236 ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil Malware Command and Control Activity Detected
TCP 192.168.56.101:49283 -> 185.215.113.77:80 2029846 ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt) A Network Trojan was detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49205
195.201.225.248:443
C=US, O=Let's Encrypt, CN=R3 CN=telecut.in 1d:7b:94:0d:d6:f9:85:f3:66:74:d5:1d:98:0c:7a:28:5b:c0:62:44

Snort Alerts

No Snort Alerts