NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.26.13.31 Active Moloch
164.124.101.2 Active Moloch
208.67.222.222 Active Moloch
35.186.245.55 Active Moloch
94.131.105.161 Active Moloch
GET 200 https://api.ip.sb/geoip
REQUEST
RESPONSE
GET 200 https://yello9erylanguage.gromovananii199.repl.co/4XR.exe
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.103:64897 -> 208.67.222.222:53 2023472 ET POLICY External IP Lookup Domain (myip .opendns .com in DNS lookup) Device Retrieving External IP Address Detected
UDP 192.168.56.103:64896 -> 208.67.222.222:53 2023472 ET POLICY External IP Lookup Domain (myip .opendns .com in DNS lookup) Device Retrieving External IP Address Detected
TCP 192.168.56.103:49200 -> 104.26.13.31:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 94.131.105.161:1337 -> 192.168.56.103:49199 2045000 ET ATTACK_RESPONSE RedLine Stealer - CheckConnect Response A Network Trojan was detected
TCP 94.131.105.161:1337 -> 192.168.56.103:49199 2045001 ET ATTACK_RESPONSE Win32/LeftHook Stealer Browser Extension Config Inbound A Network Trojan was detected
TCP 192.168.56.103:49210 -> 35.186.245.55:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 94.131.105.161:1337 -> 192.168.56.103:49199 2221010 SURICATA HTTP unable to match response to request Generic Protocol Command Decode
TCP 94.131.105.161:1337 -> 192.168.56.103:49199 2221010 SURICATA HTTP unable to match response to request Generic Protocol Command Decode

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49200
104.26.13.31:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 53:56:0b:3a:91:49:7f:18:59:87:21:98:d3:7f:98:0b:b4:ae:cb:cc
TLS 1.2
192.168.56.103:49210
35.186.245.55:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=gromovananii199.repl.co 36:65:d3:d8:40:79:65:2a:c8:25:78:9d:48:cd:44:6a:65:4d:cb:c0

Snort Alerts

No Snort Alerts