popup
NetWork | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Network Analysis

Download pcap
Hosts 6 DNS 5 TCP 6 UDP 13 HTTP(S) 1 ICMP 0 IRC 0 Suricata Snort
IP Address Status Action
147.182.174.188 Active Moloch
151.101.24.209 Active Moloch
164.124.101.2 Active Moloch
185.199.111.154 Active Moloch
191.101.130.32 Active Moloch
52.78.231.108 Active Moloch
GET 404 http://str-master.pw/strigoi/server/ping.php?lid=khonsari
REQUEST
RESPONSE
BODY 

            

        


    



        
	




                            
ICMP traffic



No ICMP traffic performed.



                            
IRC traffic



No IRC requests performed.



                            
Suricata Alerts


    

        

            Flow
            SID
            Signature
            Category
        

        
        

            
                TCP
                192.168.56.103:49169 ->
                151.101.24.209:443
            
            2028375
            ET JA3 Hash - Possible Malware - Java Based RAT
            Unknown Traffic
        

        
        

            
                TCP
                192.168.56.103:49167 ->
                151.101.24.209:443
            
            2028375
            ET JA3 Hash - Possible Malware - Java Based RAT
            Unknown Traffic
        

        
        

            
                TCP
                192.168.56.103:49171 ->
                185.199.111.154:443
            
            2028375
            ET JA3 Hash - Possible Malware - Java Based RAT
            Unknown Traffic
        

        
        

            
                TCP
                192.168.56.103:49166 ->
                52.78.231.108:443
            
            2028375
            ET JA3 Hash - Possible Malware - Java Based RAT
            Unknown Traffic
        

        
        

            
                TCP
                192.168.56.103:49168 ->
                151.101.24.209:443
            
            2028375
            ET JA3 Hash - Possible Malware - Java Based RAT
            Unknown Traffic
        

        
        

            
                UDP
                192.168.56.103:50665 ->
                164.124.101.2:53
            
            2028675
            ET POLICY DNS Query to DynDNS Domain *.ddns .net
            Potentially Bad Traffic
        

        
        

            
                UDP
                192.168.56.103:53498 ->
                164.124.101.2:53
            
            2028675
            ET POLICY DNS Query to DynDNS Domain *.ddns .net
            Potentially Bad Traffic
        

        
        

            
                UDP
                192.168.56.103:56357 ->
                164.124.101.2:53
            
            2016778
            ET DNS Query to a *.pw domain - Likely Hostile
            Potentially Bad Traffic
        

        
        

            
                TCP
                192.168.56.103:49184 ->
                147.182.174.188:80
            
            2016777
            ET INFO HTTP Request to a *.pw domain
            Potentially Bad Traffic
        

        
    




Suricata TLS


    

        

            Flow
            Issuer
            Subject
            Fingerprint
        

        
        

            
                TLS 1.2 

                192.168.56.103:49169 

                151.101.24.209:443
            		
            C=BE, O=GlobalSign nv-sa, CN=GlobalSign Atlas R3 DV TLS CA H2 2021
            CN=repo1.maven.org
            e2:ba:c2:7f:d9:98:22:e2:6b:cb:17:2c:c0:15:62:76:df:a3:21:b0
        

        
        

            
                TLS 1.2 

                192.168.56.103:49167 

                151.101.24.209:443
            		
            C=BE, O=GlobalSign nv-sa, CN=GlobalSign Atlas R3 DV TLS CA H2 2021
            CN=repo1.maven.org
            e2:ba:c2:7f:d9:98:22:e2:6b:cb:17:2c:c0:15:62:76:df:a3:21:b0
        

        
        

            
                TLS 1.2 

                192.168.56.103:49171 

                185.199.111.154:443
            		
            C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA
            C=US, ST=California, L=San Francisco, O=GitHub, Inc., CN=www.github.com
            70:94:de:dd:e6:c4:69:48:3a:92:70:a1:48:56:78:2d:18:64:e0:b7
        

        
        

            
                TLS 1.2 

                192.168.56.103:49166 

                52.78.231.108:443
            		
            C=US, O=DigiCert, Inc., CN=DigiCert High Assurance TLS Hybrid ECC SHA256 2020 CA1
            C=US, ST=California, L=San Francisco, O=GitHub, Inc., CN=github.com
            84:63:b3:a9:29:12:cc:fd:1d:31:47:05:98:9b:ec:13:99:37:d0:d7
        

        
        

            
                TLS 1.2 

                192.168.56.103:49168 

                151.101.24.209:443
            		
            C=BE, O=GlobalSign nv-sa, CN=GlobalSign Atlas R3 DV TLS CA H2 2021
            CN=repo1.maven.org
            e2:ba:c2:7f:d9:98:22:e2:6b:cb:17:2c:c0:15:62:76:df:a3:21:b0
        

        
    





                            
Snort Alerts


    
No Snort Alerts