Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| apps.identrust.com |
CNAME
a1952.dscq.akamai.net
CNAME
identrust.edgesuite.net
|
96.16.99.43 |
| clanbaker.org | 208.87.225.118 | |
| cs.com.sg | 103.237.169.99 | |
| atici.net | ||
| j2ccamionmagasin.fr | 152.228.216.255 |
- TCP Requests
-
-
192.168.56.103:49162 103.237.169.99:443cs.com.sg
-
192.168.56.103:49164 121.254.136.27:80apps.identrust.com
-
192.168.56.103:49166 152.228.216.255:443j2ccamionmagasin.fr
-
192.168.56.103:49167 152.228.216.255:443j2ccamionmagasin.fr
-
192.168.56.103:49168 152.228.216.255:443j2ccamionmagasin.fr
-
192.168.56.103:49173 208.87.225.118:80clanbaker.org
-
- UDP Requests
-
-
192.168.56.102:137 192.168.56.103:137
-
192.168.56.103:50800 164.124.101.2:53
-
192.168.56.103:52760 164.124.101.2:53
-
192.168.56.103:53673 164.124.101.2:53
-
192.168.56.103:56613 164.124.101.2:53
-
192.168.56.103:62576 164.124.101.2:53
-
192.168.56.103:64178 164.124.101.2:53
-
192.168.56.103:64894 164.124.101.2:53
-
192.168.56.103:137 192.168.56.255:137
-
192.168.56.103:53676 239.255.255.250:1900
-
8.8.8.8:53 192.168.56.103:53673
-
GET
200
http://apps.identrust.com/roots/dstrootcax3.p7c
REQUEST
RESPONSE
BODY
GET /roots/dstrootcax3.p7c HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: apps.identrust.com
HTTP/1.1 200 OK
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=15768000
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src 'self' *.identrust.com
Last-Modified: Wed, 08 Feb 2023 16:52:56 GMT
ETag: "37d-5f433188daa00"
Accept-Ranges: bytes
Content-Length: 893
X-Content-Type-Options: nosniff
X-Frame-Options: sameorigin
Content-Type: application/pkcs7-mime
Cache-Control: max-age=3600
Expires: Wed, 08 Mar 2023 05:59:06 GMT
Date: Wed, 08 Mar 2023 04:59:06 GMT
Connection: keep-alive
GET
200
http://apps.identrust.com/roots/dstrootcax3.p7c
REQUEST
RESPONSE
BODY
GET /roots/dstrootcax3.p7c HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: apps.identrust.com
HTTP/1.1 200 OK
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=15768000
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src 'self' *.identrust.com
Last-Modified: Wed, 08 Feb 2023 16:52:56 GMT
ETag: "37d-5f433188daa00"
Accept-Ranges: bytes
Content-Length: 893
X-Content-Type-Options: nosniff
X-Frame-Options: sameorigin
Content-Type: application/pkcs7-mime
Cache-Control: max-age=3600
Expires: Wed, 08 Mar 2023 05:59:06 GMT
Date: Wed, 08 Mar 2023 04:59:06 GMT
Connection: keep-alive
GET
404
http://clanbaker.org/css/khhl7kT2n69n/
REQUEST
RESPONSE
BODY
GET /css/khhl7kT2n69n/ HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E; InfoPath.3)
Host: clanbaker.org
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Date: Wed, 08 Mar 2023 04:59:20 GMT
Server: Apache/2.4.6
Content-Length: 215
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
ICMP traffic
| Source | Destination | ICMP Type | Data |
|---|---|---|---|
| 192.168.56.103 | 164.124.101.2 | 3 | |
| 192.168.56.103 | 164.124.101.2 | 3 |
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.103:49167 -> 152.228.216.255:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.103:49166 -> 152.228.216.255:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.103:49162 -> 103.237.169.99:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 152.228.216.255:443 -> 192.168.56.103:49168 | 2029340 | ET INFO TLS Handshake Failure | Potentially Bad Traffic |
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.103:49162 103.237.169.99:443 |
C=US, O=Let's Encrypt, CN=R3 | CN=cs.com.sg | 35:f9:b3:54:db:e1:bd:7b:fa:18:f4:fd:95:0b:18:ab:fd:d7:c0:c8 |
Snort Alerts
No Snort Alerts