NetWork | ZeroBOX

Network Analysis

IP Address Status Action
125.253.92.50 Active Moloch
148.251.234.93 Active Moloch
164.124.101.2 Active Moloch
62.204.41.23 Active Moloch
GET 200 http://62.204.41.23/o.png
REQUEST
RESPONSE
GET 200 http://62.204.41.23/file.png
REQUEST
RESPONSE
GET 200 http://62.204.41.23/r.png
REQUEST
RESPONSE
GET 200 http://62.204.41.23/OneDrive.png
REQUEST
RESPONSE
GET 200 http://62.204.41.23/dllhost.png
REQUEST
RESPONSE
GET 200 http://62.204.41.23/lsass.png
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 62.204.41.23:80 -> 192.168.56.101:49168 2402000 ET DROP Dshield Block Listed Source group 1 Misc Attack
TCP 62.204.41.23:80 -> 192.168.56.101:49169 2014819 ET INFO Packed Executable Download Misc activity
TCP 62.204.41.23:80 -> 192.168.56.101:49169 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 62.204.41.23:80 -> 192.168.56.101:49169 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 62.204.41.23:80 -> 192.168.56.101:49169 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 62.204.41.23:80 -> 192.168.56.101:49168 2035769 ET HUNTING [TW] Likely Hex Executable String Misc activity
TCP 62.204.41.23:80 -> 192.168.56.101:49168 2020482 ET WEB_CLIENT DRIVEBY GENERIC ShellExecute in Hex No Seps A Network Trojan was detected
TCP 62.204.41.23:80 -> 192.168.56.101:49170 2035769 ET HUNTING [TW] Likely Hex Executable String Misc activity
UDP 192.168.56.101:59002 -> 164.124.101.2:53 2036289 ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro) Crypto Currency Mining Activity Detected
TCP 192.168.56.101:49173 -> 125.253.92.50:80 2024792 ET POLICY Cryptocurrency Miner Checkin Potential Corporate Privacy Violation
TCP 192.168.56.101:49180 -> 148.251.234.93:443 2026897 ET POLICY IP Logger Redirect Domain in SNI Potential Corporate Privacy Violation
TCP 192.168.56.101:49180 -> 148.251.234.93:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49179 -> 148.251.234.93:443 2026897 ET POLICY IP Logger Redirect Domain in SNI Potential Corporate Privacy Violation
TCP 192.168.56.101:49179 -> 148.251.234.93:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49180 -> 148.251.234.93:443 2026897 ET POLICY IP Logger Redirect Domain in SNI Potential Corporate Privacy Violation
TCP 192.168.56.101:49179 -> 148.251.234.93:443 2026897 ET POLICY IP Logger Redirect Domain in SNI Potential Corporate Privacy Violation
TCP 192.168.56.101:49179 -> 148.251.234.93:443 2026897 ET POLICY IP Logger Redirect Domain in SNI Potential Corporate Privacy Violation
TCP 192.168.56.101:49180 -> 148.251.234.93:443 2026897 ET POLICY IP Logger Redirect Domain in SNI Potential Corporate Privacy Violation

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts