NetWork | ZeroBOX

Network Analysis

IP Address Status Action
164.124.101.2 Active Moloch
172.217.27.4 Active Moloch
194.190.152.92 Active Moloch
Name Response Post-Analysis Lookup
www.google.com 172.217.161.228
GET 200 https://www.google.com/
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49174 -> 194.190.152.92:5404 2037087 ET MALWARE Win32/Unknown Stealer Command (geoblock) (Outbound) Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 194.190.152.92:5404 2037084 ET MALWARE Win32/Unknown Stealer Command (filegrab) (Outbound) Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 194.190.152.92:5404 2037085 ET MALWARE Win32/Unknown Stealer Command (loader) (Outbound) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 194.190.152.92:5404 2037086 ET MALWARE Win32/Unknown Stealer Command (domaindetect) (Outbound) Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 194.190.152.92:5404 2037088 ET MALWARE Win32/Unknown Stealer CnC Log Exfil Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 194.190.152.92:5404 2037088 ET MALWARE Win32/Unknown Stealer CnC Log Exfil Malware Command and Control Activity Detected
TCP 194.190.152.92:5404 -> 192.168.56.101:49175 2260003 SURICATA Applayer Protocol detection skipped Generic Protocol Command Decode
TCP 192.168.56.101:49162 -> 172.217.27.4:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49162
172.217.27.4:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=www.google.com 78:c8:75:67:11:10:cc:4e:f6:7a:ae:7c:09:54:a1:f7:44:d8:18:e0

Snort Alerts

No Snort Alerts