NetWork | ZeroBOX

IP Address	Status	Action
164.124.101.2	Active	Moloch
94.142.143.142	Active	Moloch

Name	Response	Post-Analysis Lookup
apt.updateffboruse.com	A 94.142.143.142	94.142.143.142

No ICMP traffic performed.

No IRC requests performed.

Flow	SID	Signature	Category
TCP 192.168.56.101:49211 -> 94.142.143.142:80	2033203	ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 94.142.143.142:80	2033204	ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)	Malware Command and Control Activity Detected

No Suricata TLS

No Snort Alerts