NetWork | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

latestReport
11.18 02:11
DOCTOR FIRM ORDER FORM...
11.18 09:11
babababa.exe
11.18 09:11
Jagtfalkenes.vbs
11.18 09:11
windows_update.dll
11.18 09:11
nicko.exe
11.18 09:11
GHO%E9%95%9C%E5%83%8F%...
11.18 09:11
stories.exe
11.17 10:11
wwbizsrvs.exe
11.15 01:11
wwbizsrvs.exe
11.15 01:11
op.exe

Latest News
11.18 05:11
Strela: A newcomer in ...
11.18 05:11
A week in security (No...
11.18 05:11
A week in security (No...
11.18 04:11
카페 어니언과 함께하는 2025 코리아브...
11.18 04:11
Singapore Oil Tycoon O...
11.18 04:11
Exploit attempts for u...
11.18 04:11
NSO Group Exploited Wh...
11.18 03:11
대한민국 전통가마 연구소 ‘태고사’ 20...
11.18 03:11
더 청담, '2024 전통문화혁신사업 수...
11.18 03:11
동방이기제작소, '2024 전통문화혁신사...

NetWork | ZeroBOX

IP Address	Status	Action
147.182.174.188	Active	Moloch
151.101.24.209	Active	Moloch
164.124.101.2	Active	Moloch
173.209.48.226	Active	Moloch
185.199.109.154	Active	Moloch
52.78.231.108	Active	Moloch

Name	Response	Post-Analysis Lookup
repo1.maven.org	CNAME sonatype.map.fastly.net A 151.101.24.209	199.232.196.209
github-releases.githubusercontent.com	A 185.199.108.154 A 185.199.111.154 A 185.199.109.154 A 185.199.110.154	185.199.108.154
nightwolf.workisboring.com
str-master.pw	A 147.182.174.188	147.182.174.188
github.com	A 52.78.231.108	15.164.81.167

TCP Requests

UDP Requests

GET 404 http://str-master.pw/strigoi/server/ping.php?lid=EX1S-4U37-B1T8-TB2H-0ITG

ICMP traffic

Source	Destination	ICMP Type	Data
67.215.0.67	192.168.56.102	3
67.215.0.67	192.168.56.102	3
67.215.0.67	192.168.56.102	3
67.215.0.67	192.168.56.102	3
67.215.0.67	192.168.56.102	3
67.215.0.67	192.168.56.102	3
67.215.0.67	192.168.56.102	3
67.215.0.67	192.168.56.102	3
67.215.0.67	192.168.56.102	3
67.215.0.67	192.168.56.102	3
67.215.0.67	192.168.56.102	3
67.215.0.67	192.168.56.102	3

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49165 -> 151.101.24.209:443	2028375	ET JA3 Hash - Possible Malware - Java Based RAT	Unknown Traffic
TCP 192.168.56.102:49164 -> 52.78.231.108:443	2028375	ET JA3 Hash - Possible Malware - Java Based RAT	Unknown Traffic
TCP 192.168.56.102:49166 -> 151.101.24.209:443	2028375	ET JA3 Hash - Possible Malware - Java Based RAT	Unknown Traffic
TCP 192.168.56.102:49167 -> 151.101.24.209:443	2028375	ET JA3 Hash - Possible Malware - Java Based RAT	Unknown Traffic
TCP 192.168.56.102:49168 -> 185.199.109.154:443	2028375	ET JA3 Hash - Possible Malware - Java Based RAT	Unknown Traffic
UDP 192.168.56.102:64472 -> 164.124.101.2:53	2016778	ET DNS Query to a *.pw domain - Likely Hostile	Potentially Bad Traffic
UDP 192.168.56.102:54322 -> 164.124.101.2:53	2028756	ET POLICY DNS Query to DynDNS Domain *.workisboring .com	Potentially Bad Traffic
TCP 192.168.56.102:49180 -> 147.182.174.188:80	2030359	ET MALWARE STRRAT Initial HTTP Activity	Malware Command and Control Activity Detected
TCP 192.168.56.102:49180 -> 147.182.174.188:80	2016777	ET INFO HTTP Request to a *.pw domain	Potentially Bad Traffic

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.2 192.168.56.102:49165 151.101.24.209:443	C=BE, O=GlobalSign nv-sa, CN=GlobalSign Atlas R3 DV TLS CA H2 2021	CN=repo1.maven.org	e2:ba:c2:7f:d9:98:22:e2:6b:cb:17:2c:c0:15:62:76:df:a3:21:b0
TLS 1.2 192.168.56.102:49164 52.78.231.108:443	C=US, O=DigiCert, Inc., CN=DigiCert High Assurance TLS Hybrid ECC SHA256 2020 CA1	C=US, ST=California, L=San Francisco, O=GitHub, Inc., CN=github.com	84:63:b3:a9:29:12:cc:fd:1d:31:47:05:98:9b:ec:13:99:37:d0:d7
TLS 1.2 192.168.56.102:49166 151.101.24.209:443	C=BE, O=GlobalSign nv-sa, CN=GlobalSign Atlas R3 DV TLS CA H2 2021	CN=repo1.maven.org	e2:ba:c2:7f:d9:98:22:e2:6b:cb:17:2c:c0:15:62:76:df:a3:21:b0
TLS 1.2 192.168.56.102:49167 151.101.24.209:443	C=BE, O=GlobalSign nv-sa, CN=GlobalSign Atlas R3 DV TLS CA H2 2021	CN=repo1.maven.org	e2:ba:c2:7f:d9:98:22:e2:6b:cb:17:2c:c0:15:62:76:df:a3:21:b0
TLS 1.2 192.168.56.102:49168 185.199.109.154:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA	C=US, ST=California, L=San Francisco, O=GitHub, Inc., CN=www.github.com	70:94:de:dd:e6:c4:69:48:3a:92:70:a1:48:56:78:2d:18:64:e0:b7

Snort Alerts

No Snort Alerts