NetWork | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

latestReport
11.18 09:11
babababa.exe
11.18 09:11
Jagtfalkenes.vbs
11.18 09:11
windows_update.dll
11.18 09:11
nicko.exe
11.18 09:11
GHO%E9%95%9C%E5%83%8F%...
11.18 09:11
stories.exe
11.17 10:11
wwbizsrvs.exe
11.15 01:11
wwbizsrvs.exe
11.15 01:11
op.exe
11.15 01:11
msf.exe

Latest News
11.18 12:11
Completing the UE1’s P...
11.18 12:11
ISC Stormcast For Mond...
11.18 12:11
IT Sicherheitsnews stü...
11.18 11:11
Report on DDoSia Malwa...
11.18 11:11
전통 공예의 새로운 접근, 'M-ART(...
11.18 11:11
Die Schattenseiten des...
11.18 10:11
호텔식 샤브샤브 뷔페 '샤브올데이', 동...
11.18 10:11
창원 노인주간보호센터 '수주간보호센터 창...
11.18 09:11
더조인, ‘J-VMP’ 우수조달제품 지정...
11.18 09:11
기숙통, 11월 기숙학원 추천 정보 무료 제공

NetWork | ZeroBOX

IP Address	Status	Action
171.22.30.147	Active	Moloch

Name	Response	Post-Analysis Lookup
No hosts contacted.

TCP Requests

UDP Requests

POST 404 http://171.22.30.147/ugopounds/five/fre.php

POST 404 http://171.22.30.147/ugopounds/five/fre.php

POST 404 http://171.22.30.147/ugopounds/five/fre.php

POST 404 http://171.22.30.147/ugopounds/five/fre.php

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49167 -> 171.22.30.147:80	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	A Network Trojan was detected
TCP 192.168.56.103:49167 -> 171.22.30.147:80	2025381	ET MALWARE LokiBot Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 171.22.30.147:80	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	A Network Trojan was detected
TCP 192.168.56.103:49169 -> 171.22.30.147:80	2025381	ET MALWARE LokiBot Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49167 -> 171.22.30.147:80	2024312	ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1	A Network Trojan was detected
TCP 192.168.56.103:49167 -> 171.22.30.147:80	2024317	ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2	A Network Trojan was detected
TCP 192.168.56.103:49169 -> 171.22.30.147:80	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 171.22.30.147:80	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	Malware Command and Control Activity Detected
TCP 171.22.30.147:80 -> 192.168.56.103:49169	2025483	ET MALWARE LokiBot Fake 404 Response	A Network Trojan was detected
TCP 192.168.56.103:49168 -> 171.22.30.147:80	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	A Network Trojan was detected
TCP 192.168.56.103:49168 -> 171.22.30.147:80	2025381	ET MALWARE LokiBot Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 171.22.30.147:80	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 171.22.30.147:80	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	Malware Command and Control Activity Detected
TCP 171.22.30.147:80 -> 192.168.56.103:49168	2025483	ET MALWARE LokiBot Fake 404 Response	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 171.22.30.147:80	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 171.22.30.147:80	2025381	ET MALWARE LokiBot Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 171.22.30.147:80	2024312	ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 171.22.30.147:80	2024317	ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2	A Network Trojan was detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts