NetWork | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

NetWork | ZeroBOX

IP Address	Status	Action
104.234.10.91	Active	Moloch
162.213.196.78	Active	Moloch
164.124.101.2	Active	Moloch
178.237.33.50	Active	Moloch
192.30.89.67	Active	Moloch

Name	Response	Post-Analysis Lookup
divdemoce.duckdns.org	A 192.30.89.67	192.30.89.67
geoplugin.net	A 178.237.33.50	178.237.33.50
corpotechgroup.com	A 162.213.196.78	162.213.196.78

TCP Requests

UDP Requests

GET 200 http://104.234.10.91/477/IE_NET.exe

GET 200 http://corpotechgroup.com/Wxdypod.png

GET 200 http://geoplugin.net/json.gp

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49162 -> 104.234.10.91:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 104.234.10.91:80 -> 192.168.56.102:49162	2022050	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1	A Network Trojan was detected
TCP 104.234.10.91:80 -> 192.168.56.102:49162	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 104.234.10.91:80 -> 192.168.56.102:49162	2022051	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2	A Network Trojan was detected
TCP 104.234.10.91:80 -> 192.168.56.102:49162	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
UDP 192.168.56.102:62846 -> 164.124.101.2:53	2042936	ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain	Potentially Bad Traffic
UDP 192.168.56.102:62846 -> 164.124.101.2:53	2022918	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain	Misc activity
TCP 192.168.56.102:49170 -> 192.30.89.67:35639	2036594	ET JA3 Hash - Remcos 3.x TLS Connection	Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 192.30.89.67:35639	2036594	ET JA3 Hash - Remcos 3.x TLS Connection	Malware Command and Control Activity Detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.3 192.168.56.102:49170 192.30.89.67:35639	None	None	None
TLS 1.3 192.168.56.102:49171 192.30.89.67:35639	None	None	None

Snort Alerts

No Snort Alerts