NetWork | ZeroBOX

Network Analysis

IP Address Status Action
107.172.81.7 Active Moloch
193.233.20.26 Active Moloch
Name Response Post-Analysis Lookup
No hosts contacted.
GET 404 http://107.172.81.7/8040/vbc.exe
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49162 -> 107.172.81.7:80 2016141 ET INFO Executable Download from dotted-quad Host A Network Trojan was detected
TCP 192.168.56.101:49162 -> 107.172.81.7:80 2019714 ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts