NetWork | ZeroBOX

Network Analysis

IP Address Status Action
165.232.118.86 Active Moloch
208.95.112.1 Active Moloch
Name Response Post-Analysis Lookup
No hosts contacted.
POST 200 http://165.232.118.86/
REQUEST
RESPONSE
GET 200 http://165.232.118.86/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll
REQUEST
RESPONSE
GET 200 http://165.232.118.86/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll
REQUEST
RESPONSE
GET 200 http://165.232.118.86/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll
REQUEST
RESPONSE
GET 200 http://165.232.118.86/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll
REQUEST
RESPONSE
GET 200 http://165.232.118.86/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll
REQUEST
RESPONSE
GET 200 http://165.232.118.86/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll
REQUEST
RESPONSE
GET 200 http://165.232.118.86/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll
REQUEST
RESPONSE
POST 200 http://165.232.118.86/498c5e808a95e0c9bc9684b0df2e9aaa
REQUEST
RESPONSE
POST 200 http://165.232.118.86/498c5e808a95e0c9bc9684b0df2e9aaa
REQUEST
RESPONSE
POST 200 http://165.232.118.86/498c5e808a95e0c9bc9684b0df2e9aaa
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49164 -> 165.232.118.86:80 2036934 ET MALWARE Win32/RecordBreaker CnC Checkin M1 A Network Trojan was detected
TCP 165.232.118.86:80 -> 192.168.56.103:49164 2036955 ET MALWARE Win32/RecordBreaker CnC Checkin - Server Response A Network Trojan was detected
TCP 192.168.56.103:49164 -> 165.232.118.86:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 165.232.118.86:80 -> 192.168.56.103:49164 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 192.168.56.103:49166 -> 165.232.118.86:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 165.232.118.86:80 -> 192.168.56.103:49166 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 192.168.56.103:49166 -> 165.232.118.86:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49166 -> 165.232.118.86:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49166 -> 165.232.118.86:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49166 -> 165.232.118.86:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49166 -> 165.232.118.86:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49166 -> 165.232.118.86:80 2036884 ET HUNTING Possible Generic Stealer Sending System Information Misc activity
TCP 192.168.56.103:49166 -> 165.232.118.86:80 2036885 ET HUNTING Possible Generic Stealer Sending a Screenshot Misc activity

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts