NetWork | ZeroBOX

Network Analysis

IP Address Status Action
185.106.92.104 Active Moloch
Name Response Post-Analysis Lookup
No hosts contacted.
GET 200 http://185.106.92.104/bot/regex
REQUEST
RESPONSE
GET 200 http://185.106.92.104/bot/online?guid=TEST22-PC\\test22&key=bc2dceabe69fa26dbf4dd8295d65e03e1990633a88c1c8410825c9266b239396
REQUEST
RESPONSE
GET 200 http://185.106.92.104/bot/regex
REQUEST
RESPONSE
GET 200 http://185.106.92.104/bot/online?guid=TEST22-PC\\test22&key=bc2dceabe69fa26dbf4dd8295d65e03e1990633a88c1c8410825c9266b239396
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49165 -> 185.106.92.104:80 2039776 ET MALWARE Laplas Clipper - SetOnline CnC Checkin A Network Trojan was detected
TCP 192.168.56.103:49163 -> 185.106.92.104:80 2039776 ET MALWARE Laplas Clipper - SetOnline CnC Checkin A Network Trojan was detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts