NetWork | ZeroBOX

Network Analysis

IP Address Status Action
164.124.101.2 Active Moloch
185.199.108.133 Active Moloch
20.200.245.247 Active Moloch
GET 302 https://github.com/abjula/server/raw/main/2.rar
REQUEST
RESPONSE
GET 200 https://raw.githubusercontent.com/abjula/server/main/2.rar
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49169 -> 185.199.108.133:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49168 -> 20.200.245.247:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.2
192.168.56.103:49169
185.199.108.133:443
C=US, O=DigiCert Inc, CN=DigiCert TLS RSA SHA256 2020 CA1 C=US, ST=California, L=San Francisco, O=GitHub, Inc., CN=*.github.io a1:46:14:c7:2a:1d:52:79:f6:aa:2b:b2:c5:0a:3b:d3:f5:02:06:75
TLS 1.2
192.168.56.103:49168
20.200.245.247:443
C=US, O=DigiCert Inc, CN=DigiCert TLS Hybrid ECC SHA384 2020 CA1 C=US, ST=California, L=San Francisco, O=GitHub, Inc., CN=github.com a3:b5:9e:5f:e8:84:ee:1f:34:d9:8e:ef:85:8e:3f:b6:62:ac:10:4a

Snort Alerts

No Snort Alerts