NetWork | ZeroBOX

IP Address	Status	Action
156.96.151.237	Active	Moloch
164.124.101.2	Active	Moloch
208.95.112.1	Active	Moloch
194.5.249.24	Active	Moloch

Name	Response	Post-Analysis Lookup
concideritdone.duckdns.org	A 156.96.151.237	156.96.151.237
ip-api.com	A 208.95.112.1	208.95.112.1

TCP Requests

UDP Requests

GET 200 http://ip-api.com/json/

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.101:59369 -> 164.124.101.2:53	2022918	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain	Misc activity
UDP 192.168.56.101:54056 -> 164.124.101.2:53	2022918	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain	Misc activity
TCP 156.96.151.237:5001 -> 192.168.56.101:49212	2400015	ET DROP Spamhaus DROP Listed Traffic Inbound group 16	Misc Attack
TCP 192.168.56.101:49213 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected
TCP 192.168.56.101:49208 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected
TCP 192.168.56.101:49209 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected
TCP 192.168.56.101:49217 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected
TCP 192.168.56.101:49219 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected
TCP 192.168.56.101:49211 -> 156.96.151.237:5001	2027447	ET MALWARE WSHRAT CnC Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 156.96.151.237:5001	2027447	ET MALWARE WSHRAT CnC Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 156.96.151.237:5001	2017516	ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin 1	Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 156.96.151.237:5001	2017516	ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin 1	Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 156.96.151.237:5001	2031581	ET INFO HTTP POST Request to DuckDNS Domain	Potentially Bad Traffic
TCP 192.168.56.101:49212 -> 156.96.151.237:5001	2031581	ET INFO HTTP POST Request to DuckDNS Domain	Potentially Bad Traffic
TCP 192.168.56.101:49214 -> 156.96.151.237:5001	2027447	ET MALWARE WSHRAT CnC Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.101:49215 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected
TCP 192.168.56.101:49214 -> 156.96.151.237:5001	2017516	ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin 1	Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 156.96.151.237:5001	2031581	ET INFO HTTP POST Request to DuckDNS Domain	Potentially Bad Traffic
TCP 192.168.56.101:49216 -> 156.96.151.237:5001	2027447	ET MALWARE WSHRAT CnC Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.101:49216 -> 156.96.151.237:5001	2017516	ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin 1	Malware Command and Control Activity Detected
TCP 192.168.56.101:49216 -> 156.96.151.237:5001	2031581	ET INFO HTTP POST Request to DuckDNS Domain	Potentially Bad Traffic
TCP 192.168.56.101:49220 -> 156.96.151.237:5001	2027447	ET MALWARE WSHRAT CnC Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.101:49220 -> 156.96.151.237:5001	2017516	ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin 1	Malware Command and Control Activity Detected
TCP 192.168.56.101:49220 -> 156.96.151.237:5001	2031581	ET INFO HTTP POST Request to DuckDNS Domain	Potentially Bad Traffic
TCP 192.168.56.101:49218 -> 156.96.151.237:5001	2027447	ET MALWARE WSHRAT CnC Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.101:49218 -> 156.96.151.237:5001	2017516	ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin 1	Malware Command and Control Activity Detected
TCP 192.168.56.101:49218 -> 156.96.151.237:5001	2031581	ET INFO HTTP POST Request to DuckDNS Domain	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts