NetWork | ZeroBOX

Network Analysis

IP Address Status Action
142.250.66.74 Active Moloch
164.124.101.2 Active Moloch
GET 200 https://firebasestorage.googleapis.com/v0/b/droid-21a46.appspot.com/o/43444VBS%20NO%20STARTUP.vbs?alt=media&token=90e47504-2ac3-4d85-afe1-40f9e0a0ca50
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49162 -> 142.250.66.74:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49162
142.250.66.74:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=upload.video.google.com 22:ad:71:ad:a1:33:7e:c2:2b:d0:a9:14:30:db:5c:e4:e7:01:5d:15

Snort Alerts

No Snort Alerts