NetWork | ZeroBOX

Network Analysis

IP Address Status Action
164.124.101.2 Active Moloch
34.117.59.81 Active Moloch
62.204.41.23 Active Moloch
Name Response Post-Analysis Lookup
ipinfo.io 34.117.59.81
GET 200 http://ipinfo.io/ip
REQUEST
RESPONSE
GET 200 http://ipinfo.io/country
REQUEST
RESPONSE
POST 100 http://62.204.41.23/AVAVA/gate.php
REQUEST
RESPONSE
POST 200 http://62.204.41.23/AVAVA/gate.php
REQUEST
RESPONSE
POST 200 http://62.204.41.23/AVAVA/gate.php
REQUEST
RESPONSE
GET 200 http://62.204.41.23/a.png
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 62.204.41.23:80 -> 192.168.56.101:49168 2402000 ET DROP Dshield Block Listed Source group 1 Misc Attack
TCP 62.204.41.23:80 -> 192.168.56.101:49168 2035769 ET HUNTING [TW] Likely Hex Executable String Misc activity
TCP 192.168.56.101:49164 -> 34.117.59.81:80 2020716 ET POLICY External IP Lookup ipinfo.io Device Retrieving External IP Address Detected
TCP 192.168.56.101:49165 -> 62.204.41.23:80 2017930 ET MALWARE Trojan Generic - POST To gate.php with no referer A Network Trojan was detected
TCP 192.168.56.101:49165 -> 62.204.41.23:80 2022985 ET MALWARE Trojan Generic - POST To gate.php with no accept headers A Network Trojan was detected
TCP 62.204.41.23:80 -> 192.168.56.101:49168 2020482 ET WEB_CLIENT DRIVEBY GENERIC ShellExecute in Hex No Seps A Network Trojan was detected
TCP 192.168.56.101:49165 -> 62.204.41.23:80 2022986 ET MALWARE Generic Request to gate.php Dotted-Quad A Network Trojan was detected
TCP 192.168.56.101:49164 -> 34.117.59.81:80 2020716 ET POLICY External IP Lookup ipinfo.io Device Retrieving External IP Address Detected
TCP 192.168.56.101:49165 -> 62.204.41.23:80 2042188 ET MALWARE Win32/ModernLoader Activity (POST) A Network Trojan was detected
TCP 192.168.56.101:49165 -> 62.204.41.23:80 2017930 ET MALWARE Trojan Generic - POST To gate.php with no referer A Network Trojan was detected
TCP 192.168.56.101:49165 -> 62.204.41.23:80 2022986 ET MALWARE Generic Request to gate.php Dotted-Quad A Network Trojan was detected
TCP 62.204.41.23:80 -> 192.168.56.101:49165 2026992 ET INFO PowerShell Base64 Encoded Content Command Common In Powershell Stagers M1 A Network Trojan was detected
TCP 192.168.56.101:49165 -> 62.204.41.23:80 2017930 ET MALWARE Trojan Generic - POST To gate.php with no referer A Network Trojan was detected
TCP 192.168.56.101:49165 -> 62.204.41.23:80 2022985 ET MALWARE Trojan Generic - POST To gate.php with no accept headers A Network Trojan was detected
TCP 192.168.56.101:49165 -> 62.204.41.23:80 2022986 ET MALWARE Generic Request to gate.php Dotted-Quad A Network Trojan was detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts