NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.192.141.1 Active Moloch
164.124.101.2 Active Moloch
185.181.8.77 Active Moloch
52.217.75.116 Active Moloch
GET 302 https://bitbucket.org/trustedrootdev/file/downloads/razgon.jpg
REQUEST
RESPONSE
GET 200 https://bbuseruploads.s3.amazonaws.com/a0c2d096-5a32-4fc5-bc89-144f91b75eea/downloads/411caa37-48c8-4097-ae07-df03f10a4d1a/razgon.jpg?Signature=0vMst36P5Stk85NrQK%2B54WdYoug%3D&Expires=1639359451&AWSAccessKeyId=AKIA6KOSE3BNJRRFUUX6&versionId=WfwOKAr01OAlbnrBEoYk.OM8wgSajWQe&response-content-disposition=attachment%3B%20filename%3D%22razgon.jpg%22
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49166 -> 52.217.75.116:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49165 -> 104.192.141.1:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.2
192.168.56.101:49166
52.217.75.116:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Baltimore CA-2 G2 C=US, ST=Washington, L=Seattle, O=Amazon.com, Inc., CN=*.s3.amazonaws.com 90:e0:af:dc:fa:f7:0b:ac:50:bb:fa:43:e1:ec:e2:3d:ce:91:90:47
TLS 1.2
192.168.56.101:49165
104.192.141.1:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Extended Validation Server CA unknown=Private Organization, unknown=US, unknown=Delaware, serialNumber=3928449, C=US, ST=California, L=San Francisco, O=Atlassian, Inc., OU=Bitbucket, CN=bitbucket.org 4e:6a:4c:3b:82:15:ef:df:97:38:5e:50:ef:b9:86:42:84:3b:89:f0

Snort Alerts

No Snort Alerts