NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.26.12.31 Active Moloch
128.199.192.86 Active Moloch
164.124.101.2 Active Moloch
194.180.49.153 Active Moloch
45.15.156.208 Active Moloch
GET 200 https://api.ip.sb/ip
REQUEST
RESPONSE
POST 200 http://45.15.156.208/jd9dd3Vw/index.php
REQUEST
RESPONSE
POST 200 http://45.15.156.208/jd9dd3Vw/index.php?scr=1
REQUEST
RESPONSE
GET 200 http://194.180.49.153/udp/taskmask.exe
REQUEST
RESPONSE
POST 200 http://45.15.156.208/jd9dd3Vw/index.php
REQUEST
RESPONSE
GET 200 http://194.180.49.153/udp/rdpcllp.exe
REQUEST
RESPONSE
POST 200 http://45.15.156.208/jd9dd3Vw/index.php
REQUEST
RESPONSE
GET 200 http://194.180.49.153/udp/taskhostclp.exe
REQUEST
RESPONSE
POST 200 http://45.15.156.208/jd9dd3Vw/index.php
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49172 -> 45.15.156.208:80 2027700 ET MALWARE Amadey CnC Check-In Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 45.15.156.208:80 2045751 ET MALWARE Win32/Amadey Bot Activity (POST) M2 A Network Trojan was detected
TCP 192.168.56.101:49174 -> 194.180.49.153:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 194.180.49.153:80 -> 192.168.56.101:49174 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 194.180.49.153:80 -> 192.168.56.101:49174 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 194.180.49.153:80 -> 192.168.56.101:49174 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.101:49172 -> 45.15.156.208:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.101:49180 -> 128.199.192.86:81 2043233 ET INFO Microsoft net.tcp Connection Initialization Activity Potentially Bad Traffic
TCP 192.168.56.101:49180 -> 128.199.192.86:81 2046045 ET MALWARE [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization) A Network Trojan was detected
TCP 194.180.49.153:80 -> 192.168.56.101:49174 2014819 ET INFO Packed Executable Download Misc activity
TCP 192.168.56.101:49181 -> 104.26.12.31:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49174 -> 194.180.49.153:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.101:49173 -> 45.15.156.208:80 2044597 ET MALWARE Amadey Bot Activity (POST) M1 A Network Trojan was detected
TCP 192.168.56.101:49183 -> 45.15.156.208:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.101:49184 -> 194.180.49.153:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 194.180.49.153:80 -> 192.168.56.101:49184 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 194.180.49.153:80 -> 192.168.56.101:49184 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 194.180.49.153:80 -> 192.168.56.101:49184 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.101:49183 -> 45.15.156.208:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49181
104.26.12.31:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 53:56:0b:3a:91:49:7f:18:59:87:21:98:d3:7f:98:0b:b4:ae:cb:cc

Snort Alerts

No Snort Alerts