popup
NetWork | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Network Analysis

Download pcap
Hosts 4 DNS 0 TCP 3 UDP 4 HTTP(S) 3 ICMP 0 IRC 0 Suricata Snort
IP Address Status Action
181.129.167.82 Active Moloch
216.166.148.187 Active Moloch
45.36.99.184 Active Moloch
46.99.175.217 Active Moloch
Name Response Post-Analysis Lookup
No hosts contacted.
GET 200 https://45.36.99.184/soc1/TEST22-PC_W617601.BBEDF130CF73A299F033BBC993DA0177/5/file/
REQUEST
RESPONSE
BODY 

            

        


    



        
            

    
        GET
        
        200
        https://181.129.167.82/soc1/TEST22-PC_W617601.BBEDF130CF73A299F033BBC993DA0177/5/file/
        
    
    


        

            

                
 REQUEST

                

                    
                    
                

            

            

                
 RESPONSE

                

                    
                    
                

            

        


        

            

                 BODY
                
            

            

                

            

        


    



        
            

    
        GET
        
        200
        https://46.99.175.217/soc1/TEST22-PC_W617601.BBEDF130CF73A299F033BBC993DA0177/5/file/
        
    
    


        

            

                
 REQUEST

                

                    
                    
                

            

            

                
 RESPONSE

                

                    
                    
                

            

        


        

            

                 BODY
                
            

            

                

            

        


    



        
        
	




                            
ICMP traffic



No ICMP traffic performed.



                            
IRC traffic



No IRC requests performed.



                            
Suricata Alerts


    

        

            Flow
            SID
            Signature
            Category
        

        
        

            
                TCP
                192.168.56.103:49165 ->
                181.129.167.82:443
            
            2404307
            ET CNC Feodo Tracker Reported CnC Server group 8
            A Network Trojan was detected
        

        
        

            
                TCP
                192.168.56.103:49164 ->
                45.36.99.184:443
            
            2028401
            ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex
            Unknown Traffic
        

        
        

            
                TCP
                192.168.56.103:49167 ->
                46.99.175.217:443
            
            2404316
            ET CNC Feodo Tracker Reported CnC Server group 17
            A Network Trojan was detected
        

        
        

            
                TCP
                192.168.56.103:49165 ->
                181.129.167.82:443
            
            2028401
            ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex
            Unknown Traffic
        

        
        

            
                TCP
                45.36.99.184:443 ->
                192.168.56.103:49164
            
            2011540
            ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)
            Not Suspicious Traffic
        

        
        

            
                TCP
                192.168.56.103:49167 ->
                46.99.175.217:443
            
            2028401
            ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex
            Unknown Traffic
        

        
        

            
                TCP
                181.129.167.82:443 ->
                192.168.56.103:49165
            
            2011540
            ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)
            Not Suspicious Traffic
        

        
        

            
                TCP
                46.99.175.217:443 ->
                192.168.56.103:49167
            
            2011540
            ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)
            Not Suspicious Traffic
        

        
    




Suricata TLS


    

        

            Flow
            Issuer
            Subject
            Fingerprint
        

        
        

            
                TLSv1 

                192.168.56.103:49164 

                45.36.99.184:443
            		
            C=AU, ST=Some-State, O=Internet Widgits Pty Ltd
            C=AU, ST=Some-State, O=Internet Widgits Pty Ltd
            b5:21:a8:16:d5:97:b1:67:f6:60:a5:cb:20:27:76:ec:3c:9d:3b:02
        

        
        

            
                TLSv1 

                192.168.56.103:49165 

                181.129.167.82:443
            		
            C=AU, ST=Some-State, O=Internet Widgits Pty Ltd
            C=AU, ST=Some-State, O=Internet Widgits Pty Ltd
            b5:21:a8:16:d5:97:b1:67:f6:60:a5:cb:20:27:76:ec:3c:9d:3b:02
        

        
        

            
                TLSv1 

                192.168.56.103:49167 

                46.99.175.217:443
            		
            C=AU, ST=Some-State, O=Internet Widgits Pty Ltd
            C=AU, ST=Some-State, O=Internet Widgits Pty Ltd
            b5:21:a8:16:d5:97:b1:67:f6:60:a5:cb:20:27:76:ec:3c:9d:3b:02
        

        
    





                            
Snort Alerts


    
No Snort Alerts