NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.21.4.202 Active Moloch
149.154.167.220 Active Moloch
164.124.101.2 Active Moloch
193.122.130.0 Active Moloch
GET 200 https://newk1.shop/UUisfkPI/vice.exe
REQUEST
RESPONSE
GET 200 http://checkip.dyndns.org/
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 149.154.167.220:443 -> 192.168.56.103:49170 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49170 -> 149.154.167.220:443 2033967 ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI) Misc activity
TCP 192.168.56.103:49170 -> 149.154.167.220:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49170 -> 149.154.167.220:443 2033967 ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI) Misc activity
UDP 192.168.56.103:50800 -> 164.124.101.2:53 2042687 ET INFO DYNAMIC_DNS Query to a *.dyndns .org Domain Potentially Bad Traffic
TCP 192.168.56.103:49169 -> 193.122.130.0:80 2039190 ET MALWARE 404/Snake/Matiex Keylogger Style External IP Check A Network Trojan was detected
TCP 192.168.56.103:49169 -> 193.122.130.0:80 2021378 ET POLICY External IP Lookup - checkip.dyndns.org Device Retrieving External IP Address Detected
TCP 192.168.56.103:49169 -> 193.122.130.0:80 2042688 ET INFO DYNAMIC_DNS HTTP Request to a *.dyndns .org Domain Potentially Bad Traffic
UDP 192.168.56.103:50800 -> 164.124.101.2:53 2012758 ET INFO DYNAMIC_DNS Query to *.dyndns. Domain Misc activity
UDP 192.168.56.103:64894 -> 164.124.101.2:53 2033966 ET HUNTING Telegram API Domain in DNS Lookup Misc activity
TCP 192.168.56.103:49164 -> 104.21.4.202:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49170 -> 149.154.167.220:443 2033967 ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI) Misc activity

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49164
104.21.4.202:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=newk1.shop ab:bd:34:ca:a9:56:42:68:27:0f:bb:ee:20:1a:19:b7:71:04:58:35

Snort Alerts

No Snort Alerts