NetWork | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

NetWork | ZeroBOX

IP Address	Status	Action
117.18.232.200	Active	Moloch
104.234.10.91	Active	Moloch
164.124.101.2	Active	Moloch
178.237.33.50	Active	Moloch
192.30.89.67	Active	Moloch

Name	Response	Post-Analysis Lookup
divdemoce.duckdns.org	A 192.30.89.67	192.30.89.67
geoplugin.net	A 178.237.33.50	178.237.33.50

TCP Requests

UDP Requests

GET 200 http://104.234.10.91/433/IE_NET_CACHE.exe

GET 200 http://104.234.10.91/rmx/qyDqWM47.bin

GET 200 http://geoplugin.net/json.gp

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.101:53004 -> 164.124.101.2:53	2042936	ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain	Potentially Bad Traffic
UDP 192.168.56.101:53004 -> 164.124.101.2:53	2022918	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain	Misc activity
TCP 192.168.56.101:49168 -> 104.234.10.91:80	2018752	ET MALWARE Generic .bin download from Dotted Quad	A Network Trojan was detected
TCP 192.168.56.101:49163 -> 104.234.10.91:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 104.234.10.91:80 -> 192.168.56.101:49163	2022050	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1	A Network Trojan was detected
TCP 104.234.10.91:80 -> 192.168.56.101:49163	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 104.234.10.91:80 -> 192.168.56.101:49163	2022051	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2	A Network Trojan was detected
TCP 104.234.10.91:80 -> 192.168.56.101:49163	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.101:49169 -> 192.30.89.67:35639	2036594	ET JA3 Hash - Remcos 3.x TLS Connection	Malware Command and Control Activity Detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.3 192.168.56.101:49169 192.30.89.67:35639	None	None	None

Snort Alerts

No Snort Alerts