NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.223.76.152 Active Moloch
164.124.101.2 Active Moloch
185.199.108.133 Active Moloch
34.117.59.81 Active Moloch
46.183.223.109 Active Moloch
194.5.212.164 Active Moloch
GET 404 https://raw.githubusercontent.com/GodOfWareFare/TheGoodKidPhotos/main/rt.jpg
REQUEST
RESPONSE
GET 200 http://104.223.76.152/126/vbc.exe
REQUEST
RESPONSE
GET 200 http://ipinfo.io/ip
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49162 -> 104.223.76.152:80 2016141 ET INFO Executable Download from dotted-quad Host A Network Trojan was detected
TCP 192.168.56.103:49162 -> 104.223.76.152:80 2035207 ET MALWARE MSIL/GenKryptik.FQRH Download Request A Network Trojan was detected
TCP 192.168.56.103:49162 -> 104.223.76.152:80 2019714 ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile Potentially Bad Traffic
TCP 104.223.76.152:80 -> 192.168.56.103:49162 2022050 ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 A Network Trojan was detected
TCP 192.168.56.103:49170 -> 34.117.59.81:80 2020716 ET POLICY External IP Lookup ipinfo.io Device Retrieving External IP Address Detected
TCP 192.168.56.103:49168 -> 185.199.108.133:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 104.223.76.152:80 -> 192.168.56.103:49162 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 104.223.76.152:80 -> 192.168.56.103:49162 2022051 ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 A Network Trojan was detected
TCP 104.223.76.152:80 -> 192.168.56.103:49162 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.2
192.168.56.103:49168
185.199.108.133:443
C=US, O=DigiCert Inc, CN=DigiCert TLS RSA SHA256 2020 CA1 C=US, ST=California, L=San Francisco, O=GitHub, Inc., CN=*.github.io 8f:0e:79:24:71:c5:a7:d2:a7:46:76:30:c1:3c:b7:2a:13:b0:01:b2

Snort Alerts

No Snort Alerts