NetWork | ZeroBOX

Network Analysis

IP Address Status Action
164.124.101.2 Active Moloch
89.116.255.182 Active Moloch
Name Response Post-Analysis Lookup
No hosts contacted.
POST 200 http://89.116.255.182/c2sock
REQUEST
RESPONSE
POST 200 http://89.116.255.182/c2sock
REQUEST
RESPONSE
POST 200 http://89.116.255.182/c2sock
REQUEST
RESPONSE
POST 200 http://89.116.255.182/c2sock
REQUEST
RESPONSE
POST 200 http://89.116.255.182/c2sock
REQUEST
RESPONSE
POST 200 http://89.116.255.182/c2sock
REQUEST
RESPONSE
POST 200 http://89.116.255.182/c2sock
REQUEST
RESPONSE
POST 200 http://89.116.255.182/c2sock
REQUEST
RESPONSE
POST 200 http://89.116.255.182/c2sock
REQUEST
RESPONSE
POST 200 http://89.116.255.182/c2sock
REQUEST
RESPONSE
POST 200 http://89.116.255.182/c2sock
REQUEST
RESPONSE
POST 200 http://89.116.255.182/c2sock
REQUEST
RESPONSE
POST 200 http://89.116.255.182/c2sock
REQUEST
RESPONSE
POST 200 http://89.116.255.182/c2sock
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49191 -> 89.116.255.182:80 2043206 ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 A Network Trojan was detected
TCP 192.168.56.102:49191 -> 89.116.255.182:80 2043206 ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 A Network Trojan was detected
TCP 192.168.56.102:49191 -> 89.116.255.182:80 2043206 ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 A Network Trojan was detected
TCP 89.116.255.182:80 -> 192.168.56.102:49191 2221010 SURICATA HTTP unable to match response to request Generic Protocol Command Decode
TCP 89.116.255.182:80 -> 192.168.56.102:49191 2221010 SURICATA HTTP unable to match response to request Generic Protocol Command Decode
TCP 89.116.255.182:80 -> 192.168.56.102:49191 2221010 SURICATA HTTP unable to match response to request Generic Protocol Command Decode
TCP 89.116.255.182:80 -> 192.168.56.102:49191 2221010 SURICATA HTTP unable to match response to request Generic Protocol Command Decode
TCP 89.116.255.182:80 -> 192.168.56.102:49191 2221010 SURICATA HTTP unable to match response to request Generic Protocol Command Decode
TCP 89.116.255.182:80 -> 192.168.56.102:49191 2221010 SURICATA HTTP unable to match response to request Generic Protocol Command Decode
TCP 89.116.255.182:80 -> 192.168.56.102:49191 2221010 SURICATA HTTP unable to match response to request Generic Protocol Command Decode
TCP 89.116.255.182:80 -> 192.168.56.102:49191 2221010 SURICATA HTTP unable to match response to request Generic Protocol Command Decode
TCP 89.116.255.182:80 -> 192.168.56.102:49191 2221010 SURICATA HTTP unable to match response to request Generic Protocol Command Decode
TCP 89.116.255.182:80 -> 192.168.56.102:49191 2221010 SURICATA HTTP unable to match response to request Generic Protocol Command Decode
TCP 89.116.255.182:80 -> 192.168.56.102:49191 2221010 SURICATA HTTP unable to match response to request Generic Protocol Command Decode

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts