NetWork | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

NetWork | ZeroBOX

IP Address	Status	Action
162.19.139.184	Active	Moloch
164.124.101.2	Active	Moloch
45.32.146.65	Active	Moloch

Name	Response	Post-Analysis Lookup
accept-file.com	A 45.32.146.65	45.32.146.65
xmr.2miners.com	A 162.19.139.184	162.19.139.184

TCP Requests

UDP Requests

POST 200 http://accept-file.com/dashboard/para/un/api/endpoint.php

POST 200 http://accept-file.com/dashboard/para/un/api/endpoint.php

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49162 -> 162.19.139.184:2222	2024792	ET POLICY Cryptocurrency Miner Checkin	Potential Corporate Privacy Violation
UDP 192.168.56.103:52760 -> 164.124.101.2:53	2040353	ET COINMINER Observed DNS Query to Cryptocurrency Mining Pool Domain (xmr .2miners .com)	Crypto Currency Mining Activity Detected
TCP 192.168.56.103:49163 -> 45.32.146.65:80	2011341	ET HUNTING Suspicious POST With Reference to WINDOWS Folder Possible Malware Infection	A Network Trojan was detected
TCP 192.168.56.103:49163 -> 45.32.146.65:80	2035420	ET MALWARE Win32/Pripyat Activity (POST)	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 45.32.146.65:80	2011341	ET HUNTING Suspicious POST With Reference to WINDOWS Folder Possible Malware Infection	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 45.32.146.65:80	2035420	ET MALWARE Win32/Pripyat Activity (POST)	A Network Trojan was detected
TCP 192.168.56.103:49162 -> 162.19.139.184:2222	2024792	ET POLICY Cryptocurrency Miner Checkin	Potential Corporate Privacy Violation

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts