NetWork | ZeroBOX

Network Analysis

IP Address Status Action
149.154.167.99 Active Moloch
164.124.101.2 Active Moloch
185.163.47.176 Active Moloch
185.215.113.77 Active Moloch
193.38.54.238 Active Moloch
74.119.192.122 Active Moloch
91.219.236.162 Active Moloch
91.219.236.240 Active Moloch
POST 200 http://colonna.ug/index.php
REQUEST
RESPONSE
POST 200 http://colonna.ac.ug/softokn3.dll
REQUEST
RESPONSE
POST 200 http://colonna.ac.ug/sqlite3.dll
REQUEST
RESPONSE
POST 200 http://colonna.ac.ug/freebl3.dll
REQUEST
RESPONSE
POST 200 http://colonna.ac.ug/mozglue.dll
REQUEST
RESPONSE
POST 200 http://colonna.ac.ug/msvcp140.dll
REQUEST
RESPONSE
POST 200 http://colonna.ac.ug/nss3.dll
REQUEST
RESPONSE
POST 200 http://colonna.ac.ug/vcruntime140.dll
REQUEST
RESPONSE
POST 200 http://colonna.ac.ug/main.php
REQUEST
RESPONSE
POST 200 http://colonna.ac.ug/
REQUEST
RESPONSE

ICMP traffic

Source Destination ICMP Type Data
192.168.56.101 164.124.101.2 3

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 185.215.113.77:80 -> 192.168.56.101:49179 2400024 ET DROP Spamhaus DROP Listed Traffic Inbound group 25 Misc Attack
TCP 185.215.113.77:80 -> 192.168.56.101:49187 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 149.154.167.99:443 -> 192.168.56.101:49211 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49214 -> 149.154.167.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49207 -> 149.154.167.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49218 -> 149.154.167.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49212 -> 149.154.167.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49216 -> 149.154.167.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 149.154.167.99:443 -> 192.168.56.101:49221 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 149.154.167.99:443 -> 192.168.56.101:49213 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 149.154.167.99:443 -> 192.168.56.101:49217 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 149.154.167.99:443 -> 192.168.56.101:49219 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 149.154.167.99:443 -> 192.168.56.101:49215 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49187 -> 185.215.113.77:80 2027108 ET HUNTING Suspicious Zipped Filename in Outbound POST Request (screenshot.) M2 A Network Trojan was detected
TCP 192.168.56.101:49187 -> 185.215.113.77:80 2029236 ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil Malware Command and Control Activity Detected
TCP 192.168.56.101:49187 -> 185.215.113.77:80 2029846 ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt) A Network Trojan was detected
TCP 192.168.56.101:49187 -> 185.215.113.77:80 2033886 ET HUNTING Suspicious Zipped Filename in Outbound POST Request (Chrome_Default.txt) Potentially Bad Traffic
TCP 192.168.56.101:49220 -> 149.154.167.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts