popup
NetWork | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Network Analysis

Download pcap
Hosts 2 DNS 0 TCP 1 UDP 9 HTTP 0 ICMP 0 IRC 0 Suricata Snort
IP Address Status Action
164.124.101.2 Active Moloch
185.215.113.102 Active Moloch
Name Response Post-Analysis Lookup
No hosts contacted.

No traffic

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 185.215.113.102:1234 -> 192.168.56.101:49208 2400024 ET DROP Spamhaus DROP Listed Traffic Inbound group 25 Misc Attack
TCP 192.168.56.101:49208 -> 185.215.113.102:1234 906200098 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (BitRAT) undefined
TCP 185.215.113.102:1234 -> 192.168.56.101:49208 2030724 ET MALWARE Observed Malicious SSL Cert (BitRAT CnC) Domain Observed Used for C2 Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.2
192.168.56.101:49208
185.215.113.102:1234 		CN=BitRAT CN=BitRAT d9:f0:9e:18:ae:dd:c3:ed:5c:0a:5d:1c:8b:cb:b1:31:af:34:cf:0f

Snort Alerts

No Snort Alerts