NetWork | ZeroBOX

Network Analysis

IP Address Status Action
103.126.138.87 Active Moloch
104.21.41.183 Active Moloch
104.21.83.128 Active Moloch
164.124.101.2 Active Moloch
GET 200 https://tryno.ru/robots
REQUEST
RESPONSE
GET 200 https://anaida.evisyn.lol/dlls/Ionic.Zip.dll
REQUEST
RESPONSE
GET 200 https://anaida.evisyn.lol/dlls/EntityFramework.dll
REQUEST
RESPONSE
GET 200 https://anaida.evisyn.lol/dlls/EntityFramework.SqlServer.dll
REQUEST
RESPONSE
GET 200 https://anaida.evisyn.lol/dlls/System.Data.SQLite.dll
REQUEST
RESPONSE
GET 200 https://anaida.evisyn.lol/dlls/System.Data.SQLite.EF6.dll
REQUEST
RESPONSE
GET 200 https://anaida.evisyn.lol/dlls/System.Data.SQLite.Linq.dll
REQUEST
RESPONSE
GET 200 https://anaida.evisyn.lol/dlls/x86/SQLite.Interop.dll
REQUEST
RESPONSE
GET 200 https://anaida.evisyn.lol/dlls/x64/SQLite.Interop.dll
REQUEST
RESPONSE
GET 200 https://ipwho.is/?output=xml
REQUEST
RESPONSE
POST 100 https://anaida.evisyn.lol/c1n.php?ownerid=365&buildid=pisospro&countp=0&countc=0&username=test22&country=KR&ipaddr=175.208.134.152&BSSID=&countw=0
REQUEST
RESPONSE
GET 200 https://ipwho.is/?output=xml
REQUEST
RESPONSE
GET 200 https://anaida.evisyn.lol/online.php?country=XX&ipaddr=0.0.0.0&HWID=&processorid=&ownerid=365
REQUEST
RESPONSE
GET 200 https://anaida.evisyn.lol//list.php?id=365
REQUEST
RESPONSE
GET 0 https://anaida.evisyn.lol/getwallet.php?id=3651&wallet=nec
REQUEST
RESPONSE
GET 0 https://anaida.evisyn.lol/getwallet.php?id=365&wallet=dash
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49162 -> 104.21.83.128:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49164 -> 104.21.41.183:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49168 -> 103.126.138.87:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49174 -> 104.21.41.183:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.103:64894 -> 164.124.101.2:53 2037042 ET INFO External IP Lookup Domain in DNS Lookup (ipwho .is) Potentially Bad Traffic

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49162
104.21.83.128:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=*.tryno.ru c7:33:d0:e4:57:0d:af:57:35:25:fd:20:cc:47:c3:65:d6:37:2d:f9
TLSv1
192.168.56.103:49164
104.21.41.183:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=*.evisyn.lol 0a:f6:16:98:f6:5d:6d:37:8d:82:fc:85:3b:7b:95:74:c4:59:7a:58
TLSv1
192.168.56.103:49168
103.126.138.87:443
C=LV, L=Riga, O=GoGetSSL, CN=GoGetSSL RSA DV CA CN=ipwho.is 2a:17:81:88:c8:d8:c5:73:0c:58:4d:b4:18:93:91:a6:93:ed:e9:f0
TLSv1
192.168.56.103:49174
104.21.41.183:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=*.evisyn.lol 0a:f6:16:98:f6:5d:6d:37:8d:82:fc:85:3b:7b:95:74:c4:59:7a:58

Snort Alerts

No Snort Alerts