NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.76.70.102 Active Moloch
108.179.208.47 Active Moloch
164.124.101.2 Active Moloch
173.231.16.76 Active Moloch
194.180.48.59 Active Moloch
GET 200 https://api.ipify.org/
REQUEST
RESPONSE
GET 200 http://194.180.48.59/teambzx.exe
REQUEST
RESPONSE
GET 200 http://x1.i.lencr.org/
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49162 -> 194.180.48.59:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 194.180.48.59:80 -> 192.168.56.103:49162 2022050 ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 A Network Trojan was detected
TCP 194.180.48.59:80 -> 192.168.56.103:49162 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 194.180.48.59:80 -> 192.168.56.103:49162 2022051 ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 A Network Trojan was detected
TCP 194.180.48.59:80 -> 192.168.56.103:49162 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49168 -> 173.231.16.76:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 108.179.208.47:587 -> 192.168.56.103:49169 2260002 SURICATA Applayer Detect protocol only one direction Generic Protocol Command Decode
TCP 192.168.56.103:49169 -> 108.179.208.47:587 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.2
192.168.56.103:49168
173.231.16.76:443
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA CN=*.ipify.org f4:76:2d:2c:65:d1:15:be:19:a4:c5:e0:8d:eb:89:1a:b6:75:4a:54
TLS 1.2
192.168.56.103:49169
108.179.208.47:587
C=US, O=Let's Encrypt, CN=R3 CN=grad-vodice.hr f3:a8:c5:a8:cd:56:3b:ed:4e:4e:10:9f:f0:65:72:59:1a:a1:dc:24

Snort Alerts

No Snort Alerts