popup
NetWork | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Network Analysis

Download pcap
Hosts 6 DNS 0 TCP 2 UDP 9 HTTP(S) 3 ICMP 0 IRC 0 Suricata Snort
IP Address Status Action
164.124.101.2 Active Moloch
179.189.229.254 Active Moloch
46.99.175.149 Active Moloch
46.99.175.217 Active Moloch
60.51.47.65 Active Moloch
62.99.79.77 Active Moloch
Name Response Post-Analysis Lookup
No hosts contacted.
GET 200 https://46.99.175.217/lip138/TEST22-PC_W617601.FBB23899BD0B7BABA5FAD933B34B1531/5/file/
REQUEST
RESPONSE
BODY 

            

        


    



        
            

    
        GET
        
        200
        https://46.99.175.217/lip138/TEST22-PC_W617601.FBB23899BD0B7BABA5FAD933B34B1531/5/file/
        
    
    


        

            

                
 REQUEST

                

                    
                    
                

            

            

                
 RESPONSE

                

                    
                    
                

            

        


        

            

                 BODY
                
            

            

                

            

        


    



        
            

    
        GET
        
        200
        https://179.189.229.254/lip138/TEST22-PC_W617601.FBB23899BD0B7BABA5FAD933B34B1531/5/file/
        
    
    


        

            

                
 REQUEST

                

                    
                    
                

            

            

                
 RESPONSE

                

                    
                    
                

            

        


        

            

                 BODY
                
            

            

                

            

        


    



        
        
	




                            
ICMP traffic



No ICMP traffic performed.



                            
IRC traffic



No IRC requests performed.



                            
Suricata Alerts


    

        

            Flow
            SID
            Signature
            Category
        

        
        

            
                TCP
                192.168.56.101:49205 ->
                179.189.229.254:443
            
            2404308
            ET CNC Feodo Tracker Reported CnC Server group 9
            A Network Trojan was detected
        

        
        

            
                TCP
                192.168.56.101:49205 ->
                179.189.229.254:443
            
            2028401
            ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex
            Unknown Traffic
        

        
        

            
                TCP
                192.168.56.101:49203 ->
                46.99.175.217:443
            
            2404317
            ET CNC Feodo Tracker Reported CnC Server group 18
            A Network Trojan was detected
        

        
        

            
                TCP
                192.168.56.101:49203 ->
                46.99.175.217:443
            
            2028401
            ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex
            Unknown Traffic
        

        
        

            
                TCP
                179.189.229.254:443 ->
                192.168.56.101:49205
            
            2011540
            ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)
            Not Suspicious Traffic
        

        
        

            
                TCP
                46.99.175.217:443 ->
                192.168.56.101:49203
            
            2011540
            ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)
            Not Suspicious Traffic
        

        
    




Suricata TLS


    

        

            Flow
            Issuer
            Subject
            Fingerprint
        

        
        

            
                TLSv1 

                192.168.56.101:49205 

                179.189.229.254:443
            		
            C=AU, ST=Some-State, O=Internet Widgits Pty Ltd
            C=AU, ST=Some-State, O=Internet Widgits Pty Ltd
            b5:21:a8:16:d5:97:b1:67:f6:60:a5:cb:20:27:76:ec:3c:9d:3b:02
        

        
        

            
                TLSv1 

                192.168.56.101:49203 

                46.99.175.217:443
            		
            C=AU, ST=Some-State, O=Internet Widgits Pty Ltd
            C=AU, ST=Some-State, O=Internet Widgits Pty Ltd
            b5:21:a8:16:d5:97:b1:67:f6:60:a5:cb:20:27:76:ec:3c:9d:3b:02
        

        
    





                            
Snort Alerts


    
No Snort Alerts