popup
NetWork | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Network Analysis

Download pcap
Hosts 5 DNS 0 TCP 4 UDP 7 HTTP(S) 5 ICMP 0 IRC 0 Suricata Snort
IP Address Status Action
128.201.76.252 Active Moloch
164.124.101.2 Active Moloch
179.189.229.254 Active Moloch
185.56.175.122 Active Moloch
46.99.175.149 Active Moloch
Name Response Post-Analysis Lookup
No hosts contacted.
GET 200 https://185.56.175.122/fat1/TEST22-PC_W617601.B567912A0F3236F3B59B331D473A977B/5/file/
REQUEST
RESPONSE
BODY 

            

        


    



        
            

    
        GET
        
        200
        https://128.201.76.252/fat1/TEST22-PC_W617601.B567912A0F3236F3B59B331D473A977B/5/file/
        
    
    


        

            

                
 REQUEST

                

                    
                    
                

            

            

                
 RESPONSE

                

                    
                    
                

            

        


        

            

                 BODY
                
            

            

                

            

        


    



        
            

    
        GET
        
        200
        https://179.189.229.254/fat1/TEST22-PC_W617601.B567912A0F3236F3B59B331D473A977B/5/file/
        
    
    


        

            

                
 REQUEST

                

                    
                    
                

            

            

                
 RESPONSE

                

                    
                    
                

            

        


        

            

                 BODY
                
            

            

                

            

        


    



        
            

    
        GET
        
        200
        https://128.201.76.252/fat1/TEST22-PC_W617601.B567912A0F3236F3B59B331D473A977B/5/file/
        
    
    


        

            

                
 REQUEST

                

                    
                    
                

            

            

                
 RESPONSE

                

                    
                    
                

            

        


        

            

                 BODY
                
            

            

                

            

        


    



        
            

    
        GET
        
        200
        https://185.56.175.122/fat1/TEST22-PC_W617601.B567912A0F3236F3B59B331D473A977B/5/file/
        
    
    


        

            

                
 REQUEST

                

                    
                    
                

            

            

                
 RESPONSE

                

                    
                    
                

            

        


        

            

                 BODY
                
            

            

                

            

        


    



        
        
	




                            
ICMP traffic



No ICMP traffic performed.



                            
IRC traffic



No IRC requests performed.



                            
Suricata Alerts


    

        

            Flow
            SID
            Signature
            Category
        

        
        

            
                TCP
                192.168.56.102:49167 ->
                46.99.175.149:443
            
            2404318
            ET CNC Feodo Tracker Reported CnC Server group 19
            A Network Trojan was detected
        

        
        

            
                TCP
                192.168.56.102:49166 ->
                185.56.175.122:443
            
            2404310
            ET CNC Feodo Tracker Reported CnC Server group 11
            A Network Trojan was detected
        

        
        

            
                TCP
                192.168.56.102:49166 ->
                185.56.175.122:443
            
            2028401
            ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex
            Unknown Traffic
        

        
        

            
                TCP
                192.168.56.102:49168 ->
                128.201.76.252:443
            
            2404304
            ET CNC Feodo Tracker Reported CnC Server group 5
            A Network Trojan was detected
        

        
        

            
                TCP
                185.56.175.122:443 ->
                192.168.56.102:49166
            
            2011540
            ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)
            Not Suspicious Traffic
        

        
        

            
                TCP
                192.168.56.102:49168 ->
                128.201.76.252:443
            
            2028401
            ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex
            Unknown Traffic
        

        
        

            
                TCP
                128.201.76.252:443 ->
                192.168.56.102:49168
            
            2011540
            ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)
            Not Suspicious Traffic
        

        
        

            
                TCP
                192.168.56.102:49169 ->
                179.189.229.254:443
            
            2028401
            ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex
            Unknown Traffic
        

        
        

            
                TCP
                179.189.229.254:443 ->
                192.168.56.102:49169
            
            2011540
            ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)
            Not Suspicious Traffic
        

        
    




Suricata TLS


    

        

            Flow
            Issuer
            Subject
            Fingerprint
        

        
        

            
                TLSv1 

                192.168.56.102:49166 

                185.56.175.122:443
            		
            C=AU, ST=Some-State, O=Internet Widgits Pty Ltd
            C=AU, ST=Some-State, O=Internet Widgits Pty Ltd
            50:fd:fd:4e:2c:57:ea:f7:c9:cd:3f:61:4a:a2:40:01:1b:b8:df:02
        

        
        

            
                TLSv1 

                192.168.56.102:49168 

                128.201.76.252:443
            		
            C=AU, ST=Some-State, O=Internet Widgits Pty Ltd
            C=AU, ST=Some-State, O=Internet Widgits Pty Ltd
            b5:21:a8:16:d5:97:b1:67:f6:60:a5:cb:20:27:76:ec:3c:9d:3b:02
        

        
        

            
                TLSv1 

                192.168.56.102:49169 

                179.189.229.254:443
            		
            C=AU, ST=Some-State, O=Internet Widgits Pty Ltd
            C=AU, ST=Some-State, O=Internet Widgits Pty Ltd
            b5:21:a8:16:d5:97:b1:67:f6:60:a5:cb:20:27:76:ec:3c:9d:3b:02
        

        
    





                            
Snort Alerts


    
No Snort Alerts