NetWork | ZeroBOX

Network Analysis

IP Address Status Action
108.178.17.142 Active Moloch
148.251.234.93 Active Moloch
164.124.101.2 Active Moloch
168.119.239.218 Active Moloch
213.180.204.24 Active Moloch
5.101.152.100 Active Moloch
5.255.255.77 Active Moloch
62.217.160.2 Active Moloch
GET 302 https://yandex.ru/
REQUEST
RESPONSE
GET 0 https://dzen.ru/?yredirect=true
REQUEST
RESPONSE
GET 200 https://sso.passport.yandex.ru/push?uuid=8d007376-d291-49ab-b013-d8dcbfea0326&retpath=https%3A%2F%2Fdzen.ru%2F%3Fyredirect%3Dtrue
REQUEST
RESPONSE
GET 200 http://tokoi45.beget.tech/server.txt
REQUEST
RESPONSE
GET 200 http://tokoi45.beget.tech/server1.txt
REQUEST
RESPONSE
GET 200 http://tokoi45.beget.tech/server2.txt
REQUEST
RESPONSE
GET 404 http://allansworthng.com/1/data64_1.exe
REQUEST
RESPONSE
GET 200 http://allansworthng.com/1/data64_2.exe
REQUEST
RESPONSE
GET 200 http://allansworthng.com/1/data64_3.exe
REQUEST
RESPONSE
GET 404 http://allansworthng.com/1/data64_4.exe
REQUEST
RESPONSE
GET 404 http://allansworthng.com/1/data64_5.exe
REQUEST
RESPONSE
GET 404 http://allansworthng.com/1/data64_6.exe
REQUEST
RESPONSE
GET 200 http://allansworthng.com/webArg1.txt
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 108.178.17.142:80 -> 192.168.56.103:49170 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 108.178.17.142:80 -> 192.168.56.103:49171 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 192.168.56.103:49178 -> 5.255.255.77:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49180 -> 62.217.160.2:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49183 -> 168.119.239.218:36938 2043233 ET MALWARE RedLine Stealer TCP CnC net.tcp Init A Network Trojan was detected
TCP 192.168.56.103:49184 -> 213.180.204.24:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49185 -> 148.251.234.93:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 148.251.234.93:443 -> 192.168.56.103:49187 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49186 -> 148.251.234.93:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49178
5.255.255.77:443
C=BE, O=GlobalSign nv-sa, CN=GlobalSign ECC OV SSL CA 2018 C=RU, ST=Moscow, L=Moscow, O=Yandex LLC, CN=*.xn--d1acpjx3f.xn--p1ai 7a:e6:ff:bb:19:79:e4:52:b5:47:97:69:f8:78:1c:38:bd:e6:2f:c2
TLSv1
192.168.56.103:49180
62.217.160.2:443
C=BE, O=GlobalSign nv-sa, CN=GlobalSign RSA OV SSL CA 2018 C=RU, ST=Moscow, L=Moscow, O=VK LLC, CN=*.dzen.ru 6a:31:14:29:60:07:c9:c6:17:7b:d1:27:ad:53:57:ec:d8:c1:d8:d2
TLSv1
192.168.56.103:49184
213.180.204.24:443
C=BE, O=GlobalSign nv-sa, CN=GlobalSign RSA OV SSL CA 2018 C=RU, ST=Moscow, L=Moscow, O=Yandex LLC, CN=sso.passport.yandex.ru f0:52:26:54:41:65:2b:6a:37:7b:c1:5b:de:9c:e9:d4:41:c6:81:2d

Snort Alerts

No Snort Alerts