NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.21.62.135 Active Moloch
164.124.101.2 Active Moloch
62.109.25.138 Active Moloch
91.219.236.97 Active Moloch
Name Response Post-Analysis Lookup
teleliver.top 104.21.62.135
GET 200 http://teleliver.top/martinschpokers
REQUEST
RESPONSE
POST 200 http://91.219.236.97/
REQUEST
RESPONSE
GET 200 http://91.219.236.97//l/f/nqB27XwB3dP17SpzZSzr/8208c133edf91a84b6f782f4ed0f8693b342c36c
REQUEST
RESPONSE
GET 200 http://91.219.236.97//l/f/nqB27XwB3dP17SpzZSzr/88336169675bfeefbb16af1a9d74950c5ebfa987
REQUEST
RESPONSE
POST 200 http://91.219.236.97/
REQUEST
RESPONSE
GET 200 http://62.109.25.138/swhoct.exe
REQUEST
RESPONSE
GET 200 http://62.109.25.138/serwices.exe
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.103:60117 -> 164.124.101.2:53 2023883 ET DNS Query to a *.top domain - Likely Hostile Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 91.219.236.97:80 2033973 ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download) Malware Command and Control Activity Detected
TCP 192.168.56.103:49164 -> 104.21.62.135:80 2023882 ET INFO HTTP Request to a *.top domain Potentially Bad Traffic
TCP 91.219.236.97:80 -> 192.168.56.103:49165 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 91.219.236.97:80 -> 192.168.56.103:49165 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 91.219.236.97:80 -> 192.168.56.103:49165 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 91.219.236.97:80 2033973 ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download) Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 91.219.236.97:80 2033974 ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt Malware Command and Control Activity Detected
TCP 192.168.56.103:49233 -> 62.109.25.138:80 2016141 ET INFO Executable Download from dotted-quad Host A Network Trojan was detected
TCP 62.109.25.138:80 -> 192.168.56.103:49233 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 62.109.25.138:80 -> 192.168.56.103:49233 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 62.109.25.138:80 -> 192.168.56.103:49233 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 62.109.25.138:80 -> 192.168.56.103:49233 2014819 ET INFO Packed Executable Download Misc activity
TCP 192.168.56.103:49233 -> 62.109.25.138:80 2016141 ET INFO Executable Download from dotted-quad Host A Network Trojan was detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts