NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.192.141.1 Active Moloch
136.144.41.229 Active Moloch
164.124.101.2 Active Moloch
52.217.200.129 Active Moloch
GET 302 https://bitbucket.org/terrywells9609/rz/downloads/File.png
REQUEST
RESPONSE
GET 200 https://bbuseruploads.s3.amazonaws.com/7cb2b9a6-8bc3-49fe-a2b6-8e9aea534518/downloads/650c9764-176a-49cd-aad7-61d972772227/File.png?Signature=r3Je48wVNO1bvdlgEcYkhQoEbrA%3D&Expires=1635501151&AWSAccessKeyId=AKIA6KOSE3BNJRRFUUX6&versionId=HkGYJi0mLzSso6bzzsGO9Vs_9MOZYip6&response-content-disposition=attachment%3B%20filename%3D%22File.png%22
REQUEST
RESPONSE
GET 200 http://136.144.41.229/public/sqlite3.dll
REQUEST
RESPONSE
GET 200 http://136.144.41.229/gJCbU1V9y2.php
REQUEST
RESPONSE
POST 200 http://136.144.41.229/gJCbU1V9y2.php
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49201 -> 104.192.141.1:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49205 -> 136.144.41.229:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.101:49202 -> 52.217.200.129:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 136.144.41.229:80 -> 192.168.56.101:49205 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 136.144.41.229:80 -> 192.168.56.101:49205 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 192.168.56.101:49205 -> 136.144.41.229:80 2033163 ET MALWARE Win32/Vidar Variant Stealer CnC Exfil A Network Trojan was detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.2
192.168.56.101:49201
104.192.141.1:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Extended Validation Server CA unknown=Private Organization, unknown=US, unknown=Delaware, serialNumber=3928449, C=US, ST=California, L=San Francisco, O=Atlassian, Inc., OU=Bitbucket, CN=bitbucket.org 4e:6a:4c:3b:82:15:ef:df:97:38:5e:50:ef:b9:86:42:84:3b:89:f0
TLS 1.2
192.168.56.101:49202
52.217.200.129:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Baltimore CA-2 G2 C=US, ST=Washington, L=Seattle, O=Amazon.com, Inc., CN=*.s3.amazonaws.com 90:e0:af:dc:fa:f7:0b:ac:50:bb:fa:43:e1:ec:e2:3d:ce:91:90:47

Snort Alerts

No Snort Alerts