NetWork | ZeroBOX

Network Analysis

IP Address Status Action
164.124.101.2 Active Moloch
192.64.117.201 Active Moloch
Name Response Post-Analysis Lookup
takpo.biz 192.64.117.201
POST 200 http://takpo.biz/6.jpg
REQUEST
RESPONSE
POST 200 http://takpo.biz/1.jpg
REQUEST
RESPONSE
POST 200 http://takpo.biz/2.jpg
REQUEST
RESPONSE
POST 200 http://takpo.biz/3.jpg
REQUEST
RESPONSE
POST 200 http://takpo.biz/4.jpg
REQUEST
RESPONSE
POST 200 http://takpo.biz/5.jpg
REQUEST
RESPONSE
POST 200 http://takpo.biz/7.jpg
REQUEST
RESPONSE
POST 200 http://takpo.biz/main.php
REQUEST
RESPONSE
POST 200 http://takpo.biz/
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:55871 -> 164.124.101.2:53 2027863 ET INFO Observed DNS Query to .biz TLD Potentially Bad Traffic
TCP 192.168.56.101:49164 -> 192.64.117.201:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.64.117.201:80 -> 192.168.56.101:49164 2026537 ET HUNTING Suspicious EXE Download Content-Type image/jpeg Potential Corporate Privacy Violation
TCP 192.64.117.201:80 -> 192.168.56.101:49164 2023464 ET HUNTING Possible EXE Download From Suspicious TLD Misc activity
TCP 192.168.56.101:49166 -> 192.64.117.201:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.64.117.201:80 -> 192.168.56.101:49166 2026537 ET HUNTING Suspicious EXE Download Content-Type image/jpeg Potential Corporate Privacy Violation
TCP 192.64.117.201:80 -> 192.168.56.101:49166 2023464 ET HUNTING Possible EXE Download From Suspicious TLD Misc activity
TCP 192.168.56.101:49164 -> 192.64.117.201:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.64.117.201:80 -> 192.168.56.101:49164 2023464 ET HUNTING Possible EXE Download From Suspicious TLD Misc activity
TCP 192.168.56.101:49164 -> 192.64.117.201:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.64.117.201:80 -> 192.168.56.101:49164 2023464 ET HUNTING Possible EXE Download From Suspicious TLD Misc activity
TCP 192.168.56.101:49164 -> 192.64.117.201:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.168.56.101:49164 -> 192.64.117.201:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.168.56.101:49166 -> 192.64.117.201:80 2010067 ET POLICY Data POST to an image file (jpg) A Network Trojan was detected
TCP 192.168.56.101:49166 -> 192.64.117.201:80 2027108 ET HUNTING Suspicious Zipped Filename in Outbound POST Request (screenshot.) M2 A Network Trojan was detected
TCP 192.168.56.101:49166 -> 192.64.117.201:80 2029236 ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 192.64.117.201:80 2029846 ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt) A Network Trojan was detected
TCP 192.168.56.101:49166 -> 192.64.117.201:80 2033886 ET HUNTING Suspicious Zipped Filename in Outbound POST Request (Chrome_Default.txt) Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts