Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| raw.githubusercontent.com | 185.199.110.133 | |
| pastebin.com | 104.23.98.190 | |
| xmr-asia1.nanopool.org | 139.99.102.73 |
- UDP Requests
-
-
192.168.56.102:52062 164.124.101.2:53
-
192.168.56.102:52336 164.124.101.2:53
-
192.168.56.102:58838 164.124.101.2:53
-
192.168.56.102:64034 164.124.101.2:53
-
192.168.56.102:64995 164.124.101.2:53
-
192.168.56.102:137 192.168.56.255:137
-
192.168.56.102:138 192.168.56.255:138
-
192.168.56.102:49152 239.255.255.250:3702
-
192.168.56.102:49164 239.255.255.250:1900
-
52.231.114.183:123 192.168.56.102:123
-
No traffic
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| UDP 192.168.56.102:58838 -> 164.124.101.2:53 | 2033268 | ET POLICY Observed DNS Query to Coin Mining Domain (nanopool .org) | Potential Corporate Privacy Violation |
| TCP 192.168.56.102:49175 -> 139.99.102.74:14444 | 2024792 | ET POLICY Cryptocurrency Miner Checkin | Potential Corporate Privacy Violation |
| TCP 192.168.56.102:49173 -> 104.23.99.190:443 | 906200070 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (CoinMiner) | undefined |
| TCP 192.168.56.102:49174 -> 185.199.109.133:443 | 906200070 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (CoinMiner) | undefined |
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLS 1.3 192.168.56.102:49173 104.23.99.190:443 |
None | None | None |
|
TLS 1.3 192.168.56.102:49174 185.199.109.133:443 |
None | None | None |
Snort Alerts
No Snort Alerts