NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.131.11.205 Active Moloch
138.197.109.175 Active Moloch
164.124.101.2 Active Moloch
187.84.80.182 Active Moloch
213.128.75.146 Active Moloch
216.158.226.206 Active Moloch
68.183.94.239 Active Moloch
79.143.187.147 Active Moloch
81.95.101.8 Active Moloch
GET 200 http://www.garantihaliyikama.com/wp-admin/FjgB6I/
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49166 -> 81.95.101.8:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 81.95.101.8:443 -> 192.168.56.103:49167 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49176 -> 68.183.94.239:80 2404318 ET CNC Feodo Tracker Reported CnC Server group 19 A Network Trojan was detected
TCP 192.168.56.103:49165 -> 81.95.101.8:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49179 -> 187.84.80.182:443 2404309 ET CNC Feodo Tracker Reported CnC Server group 10 A Network Trojan was detected
TCP 192.168.56.103:49180 -> 79.143.187.147:443 2404320 ET CNC Feodo Tracker Reported CnC Server group 21 A Network Trojan was detected
TCP 213.128.75.146:80 -> 192.168.56.103:49169 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 213.128.75.146:80 -> 192.168.56.103:49169 2022053 ET MALWARE Likely Evil EXE download from MSXMLHTTP non-exe extension M2 A Network Trojan was detected
TCP 213.128.75.146:80 -> 192.168.56.103:49169 2014520 ET INFO EXE - Served Attached HTTP Misc activity
TCP 192.168.56.103:49177 -> 104.131.11.205:443 2404301 ET CNC Feodo Tracker Reported CnC Server group 2 A Network Trojan was detected
TCP 192.168.56.103:49178 -> 138.197.109.175:8080 2404304 ET CNC Feodo Tracker Reported CnC Server group 5 A Network Trojan was detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts