NetWork | ZeroBOX

Network Analysis

IP Address Status Action
164.124.101.2 Active Moloch
176.31.32.198 Active Moloch
34.117.59.81 Active Moloch
50.16.239.65 Active Moloch
62.109.1.30 Active Moloch
GET 200 https://ipinfo.io/json
REQUEST
RESPONSE
GET 200 https://api.ipify.org/
REQUEST
RESPONSE
GET 200 http://62.109.1.30/triggers/vm_.php?V9JL2L5tBWjPnGs3XTcD6uK=68l9j&Dk8ljd7jBYa4EX9b4TcqyURjwkzCP4k=KBT9RBgP5yRDnCqwGfESh2LsTYz8o4&e8f6de43394a8e2ef93b201a0d2ec922=c0280c4c3f572aabfa038560a3f515da&65ab24948c084368808c084126a043f5=QNkZTNzcDOwMWM5QGM4YzMyQmY2MGZmV2MmdDOjN2MiF2M5gDM2MGO&V9JL2L5tBWjPnGs3XTcD6uK=68l9j&Dk8ljd7jBYa4EX9b4TcqyURjwkzCP4k=KBT9RBgP5yRDnCqwGfESh2LsTYz8o4
REQUEST
RESPONSE
GET 200 http://176.31.32.198/VideoRecoderDriveMaster.exe
REQUEST
RESPONSE
GET 200 http://62.109.1.30/triggers/vm_.php?V9JL2L5tBWjPnGs3XTcD6uK=68l9j&Dk8ljd7jBYa4EX9b4TcqyURjwkzCP4k=KBT9RBgP5yRDnCqwGfESh2LsTYz8o4&02a02393cf420479d23438ff09302b99=jNDZkFTN2EWO4ITZiFGZ0UWYlVGZyM2NmVGM4MzNzU2Y4QjNmhDNjBDMyEjM1ETNyIDN3MTM&65ab24948c084368808c084126a043f5=wMmhDNzQjYmZTYiRzNxMTOjVWY0I2NhZWN0MTO5MGNxgjMxgjY0EmY&0c2329b9f0dc4c64441b4dcf29994306=d1nIhRDM1cjNwYmYlJzYmV2MjVmYlVjNjZ2M5cTM4YTO0QDOxgDNyI2NkJiOigDN5kTNxYTM2EzM0YTNjVmMiR2MjN2YygDO3M2MhNWYiwiI0cTM2M2Y4EDM2YTZ5IzNmZTNiRWM5ETM4YGO4IjY0YDM0czMjJWM0IiOiYGNlBjNkJGOwkDZjhjZjVjNiVDO3kzM5ETYmBjMkRGOis3W&fc24c3366cf2f1612650240a4476fd9c=QX9JiI6ISYihjZiVzYmJWM1EWMmRjY1EjYmBzMlVTOzQDO3EjM1ICLiEGNwUzN2AjZiVmMjZWZzMWZiVWN2MmZzkzNxgjN5QDN4EDO0IjY3QmI6ICO0kTO1EjNxYTMzQjN1MWZyIGZzM2YjJDO4czYzE2YhJCLiQzNxYzYjhTMwYjNlljM3YmN1IGZxkTMxgjZ4gjMiRjNwQzNzMmYxQjI6IiZ0UGM2QmY4ATOkNGOmNWN2IWN4cTOzkTMhZGMyQGZ4Iyes0nI5EjbJpXMHlEerRVTp9maJRzZU5Uaa1WTw0kaZpmVX10MJJTT5F1RaJTRyk1aGpmTsJlMOxmUtpVaO1mTsJkeO1mUql1aKlXZ2k0UZBjRHJFMohlWpdXaJlnVyoFa1cVWOJ0UihmSzoldKhUVp9maJNTOHpVdsJjVV5UVRl2dplkWKl2TpRzVhRnUXFles1WSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSzxWbkZkSp9UajVVUVp0QMlWUYF2QCNkTyEUaUxkQDJGa1IjYw50MjxmWyIWeCZUSzEUejNTOHpVdsJjVp9maJlnVtZVdsJjVpd3Uml2ZHRWMGJjW1xmMjpHbXJmd4cVY1hTbaVHbHNGc5kHT20ESjBjUIFWavpWSsFzRahmVtNWa3lWSzZ1MixmTxwEasJzYCpUaPlWVtJmdwhlW0x2Rkl2dplkMnRVT6FkaJZTSDJGaSNzY2JkbJNXSTJmdOdlWzZ1RWdWRXpVe5IzUnllaONTU6VlQKl2TpNWbjZnSDxUaRR0TzsmaMJTSU10cBpmTyUlaMNTTqlkNJlXW2hXbJNXSpVFTKl2TptmbjBTNXRmdO1WSzl0QiFTOXpFVKl2TpRjMiBHZXpVeKNETpd3VkZnVyUVavpWS1IFWhpmSDxUaBRlT4RzQOpXRqxENBpWT1VleOhXSp9UaBhVYpNnbPlGOtpVdsV0YKp0QMlWSq1EMOhlWwoUaPlWVXJGa1s2Ys5EWWl2dplERCZFT5lERWRlVFZVavpWSsFzVZ9kTFVVa3lWSzQzQOVXUqlkNJl2YspFbjxmWuNGbOxWSzlUallEZF1EN0kWTnFURJZlQxE1ZBRUTwcGVMFzaHlEcwUkVvVVbjZnTFlEcJZ0SzZ1RkVHbrlkNJNlW0ZUbUZlQxEVa3lWSDJ0QNdGMDl0dTl1NSlHN2ATYKdzZwwEb0pGcuJna3QXcENVUIplRJF0ULdzYHp1Np9maJxWMXl1TWZUVIp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEmY4YmY1MmZiFTNhFjZ0IWNxImZwMTZ1kzM0gzNxITNiwiIkRmYxUzN0kDZhRWZlRzY2UWMyEWZ2IjMmJTYyYGMhJTM1gTOhNmNjJiOigDN5kTNxYTM2EzM0YTNjVmMiR2MjN2YygDO3M2MhNWYiwiI0cTM2M2Y4EDM2YTZ5IzNmZTNiRWM5ETM4YGO4IjY0YDM0czMjJWM0IiOiYGNlBjNkJGOwkDZjhjZjVjNiVDO3kzM5ETYmBjMkRGOis3W
REQUEST
RESPONSE
GET 200 http://62.109.1.30/triggers/vm_.php?V9JL2L5tBWjPnGs3XTcD6uK=68l9j&Dk8ljd7jBYa4EX9b4TcqyURjwkzCP4k=KBT9RBgP5yRDnCqwGfESh2LsTYz8o4&02a02393cf420479d23438ff09302b99=jNDZkFTN2EWO4ITZiFGZ0UWYlVGZyM2NmVGM4MzNzU2Y4QjNmhDNjBDMyEjM1ETNyIDN3MTM&65ab24948c084368808c084126a043f5=wMmhDNzQjYmZTYiRzNxMTOjVWY0I2NhZWN0MTO5MGNxgjMxgjY0EmY&0c2329b9f0dc4c64441b4dcf29994306=d1nIhRDM1cjNwYmYlJzYmV2MjVmYlVjNjZ2M5cTM4YTO0QDOxgDNyI2NkJiOigDN5kTNxYTM2EzM0YTNjVmMiR2MjN2YygDO3M2MhNWYiwiI0cTM2M2Y4EDM2YTZ5IzNmZTNiRWM5ETM4YGO4IjY0YDM0czMjJWM0IiOiYGNlBjNkJGOwkDZjhjZjVjNiVDO3kzM5ETYmBjMkRGOis3W&fc24c3366cf2f1612650240a4476fd9c=QX9JiI6ISYihjZiVzYmJWM1EWMmRjY1EjYmBzMlVTOzQDO3EjM1ICLiEGNwUzN2AjZiVmMjZWZzMWZiVWN2MmZzkzNxgjN5QDN4EDO0IjY3QmI6ICO0kTO1EjNxYTMzQjN1MWZyIGZzM2YjJDO4czYzE2YhJCLiQzNxYzYjhTMwYjNlljM3YmN1IGZxkTMxgjZ4gjMiRjNwQzNzMmYxQjI6IiZ0UGM2QmY4ATOkNGOmNWN2IWN4cTOzkTMhZGMyQGZ4Iyes0nI5EjbJpXMHlEerRVTp9maJRzZU5Uaa1WTw0kaZpmVX10MJJTT5F1RaJTRyk1aGpmTsJlMOxmUtpVaO1mTsJkeO1mUql1aKlXZ2k0UZBjRHJFMohlWpdXaJlnVyoFa1cVWOJ0UihmSzoldKhUVp9maJNTOHpVdsJjVV5UVRl2dplkWKl2TpRzVhRnUXFles1WSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSzxWbkZkSp9UajVVUVp0QMlWUYF2QCNkTyEUaUxkQDJGa1IjYw50MjxmWyIWeCZUSzEUejNTOHpVdsJjVp9maJlnVtZVdsJjVpd3Uml2ZHRWMGJjW1xmMjpHbXJmd4cVY1hTbaVHbHNGc5kHT20ESjBjUIFWavpWSsFzRahmVtNWa3lWSzZ1MixmTxwEasJzYCpUaPlWVtJmdwhlW0x2Rkl2dplkMnRVT6FkaJZTSDJGaSNzY2JkbJNXSTJmdOdlWzZ1RWdWRXpVe5IzUnllaONTU6VlQKl2TpNWbjZnSDxUaRR0TzsmaMJTSU10cBpmTyUlaMNTTqlkNJlXW2hXbJNXSpVFTKl2TptmbjBTNXRmdO1WSzl0QiFTOXpFVKl2TpRjMiBHZXpVeKNETpd3VkZnVyUVavpWS1IFWhpmSDxUaBRlT4RzQOpXRqxENBpWT1VleOhXSp9UaBhVYpNnbPlGOtpVdsV0YKp0QMlWSq1EMOhlWwoUaPlWVXJGa1s2Ys5EWWl2dplERCZFT5lERWRlVFZVavpWSsFzVZ9kTFVVa3lWSzQzQOVXUqlkNJl2YspFbjxmWuNGbOxWSzlUallEZF1EN0kWTnFURJZlQxE1ZBRUTwcGVMFzaHlEcwUkVvVVbjZnTFlEcJZ0SzZ1RkVHbrlkNJNlW0ZUbUZlQxEVa3lWSDJ0QNdGMDl0dTl1NSlHN2ATYKdzZwwEb0pGcuJna3QXcENVUIplRJF0ULdzYHp1Np9maJxWMXl1TWZUVIp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEmY4YmY1MmZiFTNhFjZ0IWNxImZwMTZ1kzM0gzNxITNiwiIkRmYxUzN0kDZhRWZlRzY2UWMyEWZ2IjMmJTYyYGMhJTM1gTOhNmNjJiOigDN5kTNxYTM2EzM0YTNjVmMiR2MjN2YygDO3M2MhNWYiwiI0cTM2M2Y4EDM2YTZ5IzNmZTNiRWM5ETM4YGO4IjY0YDM0czMjJWM0IiOiYGNlBjNkJGOwkDZjhjZjVjNiVDO3kzM5ETYmBjMkRGOis3W
REQUEST
RESPONSE

ICMP traffic

Source Destination ICMP Type Data
192.168.56.102 62.109.1.30 8 abcdefghijklmnopqrstuvwabcdefghi
192.168.56.102 62.109.1.30 8 abcdefghijklmnopqrstuvwabcdefghi
62.109.1.30 192.168.56.102 0 abcdefghijklmnopqrstuvwabcdefghi
192.168.56.102 62.109.1.30 3
62.109.1.30 192.168.56.102 0 abcdefghijklmnopqrstuvwabcdefghi
192.168.56.102 62.109.1.30 8 abcdefghijklmnopqrstuvwabcdefghi
62.109.1.30 192.168.56.102 0 abcdefghijklmnopqrstuvwabcdefghi
192.168.56.102 62.109.1.30 8 abcdefghijklmnopqrstuvwabcdefghi
62.109.1.30 192.168.56.102 0 abcdefghijklmnopqrstuvwabcdefghi
192.168.56.102 62.109.1.30 3
192.168.56.102 62.109.1.30 8 abcdefghijklmnopqrstuvwabcdefghi
62.109.1.30 192.168.56.102 0 abcdefghijklmnopqrstuvwabcdefghi
192.168.56.102 62.109.1.30 8 abcdefghijklmnopqrstuvwabcdefghi
62.109.1.30 192.168.56.102 0 abcdefghijklmnopqrstuvwabcdefghi
192.168.56.102 62.109.1.30 3
192.168.56.102 62.109.1.30 8 abcdefghijklmnopqrstuvwabcdefghi
62.109.1.30 192.168.56.102 0 abcdefghijklmnopqrstuvwabcdefghi
192.168.56.102 62.109.1.30 3
192.168.56.102 62.109.1.30 8 abcdefghijklmnopqrstuvwabcdefghi
62.109.1.30 192.168.56.102 0 abcdefghijklmnopqrstuvwabcdefghi
192.168.56.102 62.109.1.30 8 abcdefghijklmnopqrstuvwabcdefghi
62.109.1.30 192.168.56.102 0 abcdefghijklmnopqrstuvwabcdefghi
192.168.56.102 62.109.1.30 8 abcdefghijklmnopqrstuvwabcdefghi
62.109.1.30 192.168.56.102 0 abcdefghijklmnopqrstuvwabcdefghi
192.168.56.102 62.109.1.30 8 abcdefghijklmnopqrstuvwabcdefghi
62.109.1.30 192.168.56.102 0 abcdefghijklmnopqrstuvwabcdefghi
192.168.56.102 62.109.1.30 8 abcdefghijklmnopqrstuvwabcdefghi
62.109.1.30 192.168.56.102 0 abcdefghijklmnopqrstuvwabcdefghi
192.168.56.102 62.109.1.30 3
192.168.56.102 62.109.1.30 8 abcdefghijklmnopqrstuvwabcdefghi
62.109.1.30 192.168.56.102 0 abcdefghijklmnopqrstuvwabcdefghi
192.168.56.102 62.109.1.30 3
192.168.56.102 62.109.1.30 8 abcdefghijklmnopqrstuvwabcdefghi
62.109.1.30 192.168.56.102 0 abcdefghijklmnopqrstuvwabcdefghi
192.168.56.102 62.109.1.30 8 abcdefghijklmnopqrstuvwabcdefghi
62.109.1.30 192.168.56.102 0 abcdefghijklmnopqrstuvwabcdefghi
192.168.56.102 62.109.1.30 3
192.168.56.102 62.109.1.30 8 abcdefghijklmnopqrstuvwabcdefghi
62.109.1.30 192.168.56.102 0 abcdefghijklmnopqrstuvwabcdefghi
192.168.56.102 62.109.1.30 3
192.168.56.102 62.109.1.30 8 abcdefghijklmnopqrstuvwabcdefghi
62.109.1.30 192.168.56.102 0 abcdefghijklmnopqrstuvwabcdefghi
192.168.56.102 62.109.1.30 8 abcdefghijklmnopqrstuvwabcdefghi
62.109.1.30 192.168.56.102 0 abcdefghijklmnopqrstuvwabcdefghi
192.168.56.102 62.109.1.30 3
192.168.56.102 62.109.1.30 8 abcdefghijklmnopqrstuvwabcdefghi
62.109.1.30 192.168.56.102 0 abcdefghijklmnopqrstuvwabcdefghi
192.168.56.102 62.109.1.30 3
192.168.56.102 62.109.1.30 8 abcdefghijklmnopqrstuvwabcdefghi
62.109.1.30 192.168.56.102 0 abcdefghijklmnopqrstuvwabcdefghi
192.168.56.102 62.109.1.30 8 abcdefghijklmnopqrstuvwabcdefghi
62.109.1.30 192.168.56.102 0 abcdefghijklmnopqrstuvwabcdefghi
192.168.56.102 62.109.1.30 3
192.168.56.102 62.109.1.30 8 abcdefghijklmnopqrstuvwabcdefghi
62.109.1.30 192.168.56.102 0 abcdefghijklmnopqrstuvwabcdefghi
192.168.56.102 62.109.1.30 8 abcdefghijklmnopqrstuvwabcdefghi
62.109.1.30 192.168.56.102 0 abcdefghijklmnopqrstuvwabcdefghi
192.168.56.102 62.109.1.30 3
192.168.56.102 62.109.1.30 8 abcdefghijklmnopqrstuvwabcdefghi
62.109.1.30 192.168.56.102 0 abcdefghijklmnopqrstuvwabcdefghi

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49171 -> 176.31.32.198:80 2016141 ET INFO Executable Download from dotted-quad Host A Network Trojan was detected
TCP 176.31.32.198:80 -> 192.168.56.102:49171 2014819 ET INFO Packed Executable Download Misc activity
TCP 176.31.32.198:80 -> 192.168.56.102:49171 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 176.31.32.198:80 -> 192.168.56.102:49171 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 176.31.32.198:80 -> 192.168.56.102:49171 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.102:49174 -> 34.117.59.81:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.102:49174 -> 34.117.59.81:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 34.117.59.81:443 -> 192.168.56.102:49174 2025330 ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io) Device Retrieving External IP Address Detected
TCP 192.168.56.102:49175 -> 50.16.239.65:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49174
34.117.59.81:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1D4 CN=ipinfo.io 9b:8a:7e:73:93:70:47:e8:1f:ef:b1:b9:f4:52:8b:2f:90:2c:85:2e
TLSv1
192.168.56.102:49175
50.16.239.65:443
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA CN=*.ipify.org 6f:de:ae:2b:9f:c6:cd:5b:7f:5c:d0:69:fa:c8:8b:62:19:fd:56:ad

Snort Alerts

No Snort Alerts