NetWork | ZeroBOX

Network Analysis

IP Address Status Action
149.154.167.99 Active Moloch
164.124.101.2 Active Moloch
185.215.113.77 Active Moloch
POST 0 http://colonna.ug/index.php
REQUEST
RESPONSE
POST 200 http://colonna.ac.ug/softokn3.dll
REQUEST
RESPONSE
POST 200 http://colonna.ac.ug/sqlite3.dll
REQUEST
RESPONSE
POST 200 http://colonna.ac.ug/freebl3.dll
REQUEST
RESPONSE
POST 200 http://colonna.ac.ug/mozglue.dll
REQUEST
RESPONSE
POST 200 http://colonna.ac.ug/msvcp140.dll
REQUEST
RESPONSE
POST 200 http://colonna.ac.ug/nss3.dll
REQUEST
RESPONSE

ICMP traffic

Source Destination ICMP Type Data
192.168.56.103 164.124.101.2 3

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 185.215.113.77:80 -> 192.168.56.103:49173 2400024 ET DROP Spamhaus DROP Listed Traffic Inbound group 25 Misc Attack
TCP 185.215.113.77:80 -> 192.168.56.103:49173 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 192.168.56.103:49179 -> 149.154.167.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 185.215.113.77:80 -> 192.168.56.103:49170 2029138 ET MALWARE AZORult v3.3 Server Response M3 Malware Command and Control Activity Detected
TCP 149.154.167.99:443 -> 192.168.56.103:49186 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49187 -> 149.154.167.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 149.154.167.99:443 -> 192.168.56.103:49188 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49189 -> 149.154.167.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.103:60117 -> 164.124.101.2:53 2023883 ET DNS Query to a *.top domain - Likely Hostile Potentially Bad Traffic
TCP 185.215.113.77:80 -> 192.168.56.103:49176 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 149.154.167.99:443 -> 192.168.56.103:49184 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
UDP 192.168.56.103:51958 -> 8.8.8.8:53 2023883 ET DNS Query to a *.top domain - Likely Hostile Potentially Bad Traffic
TCP 192.168.56.103:49181 -> 149.154.167.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49183 -> 149.154.167.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49185 -> 149.154.167.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 149.154.167.99:443 -> 192.168.56.103:49180 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 149.154.167.99:443 -> 192.168.56.103:49182 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts