NetWork | ZeroBOX

Network Analysis

IP Address Status Action
164.124.101.2 Active Moloch
171.22.28.214 Active Moloch
23.32.56.72 Active Moloch
34.117.59.81 Active Moloch
GET 200 https://ipinfo.io/widget/demo/175.208.134.152
REQUEST
RESPONSE
GET 200 http://apps.identrust.com/roots/dstrootcax3.p7c
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 171.22.28.214:50500 -> 192.168.56.103:49163 2046266 ET MALWARE [ANY.RUN] RisePro TCP v.0.x (Token) Malware Command and Control Activity Detected
TCP 171.22.28.214:50500 -> 192.168.56.103:49163 2046267 ET MALWARE [ANY.RUN] RisePro TCP v.0.x (External IP) Malware Command and Control Activity Detected
TCP 171.22.28.214:50500 -> 192.168.56.103:49163 2046267 ET MALWARE [ANY.RUN] RisePro TCP v.0.x (External IP) Malware Command and Control Activity Detected
TCP 192.168.56.103:49163 -> 171.22.28.214:50500 2046270 ET MALWARE [ANY.RUN] RisePro TCP v.0.x (Exfiltration) Malware Command and Control Activity Detected
TCP 192.168.56.103:49164 -> 34.117.59.81:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.103:49164 -> 34.117.59.81:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 34.117.59.81:443 -> 192.168.56.103:49164 2025330 ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io) Device Retrieving External IP Address Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.2
192.168.56.103:49164
34.117.59.81:443
C=US, O=Let's Encrypt, CN=R3 CN=ipinfo.io 93:12:24:ee:db:ec:6e:1f:10:38:75:88:62:ff:ae:40:74:b7:f8:f3

Snort Alerts

No Snort Alerts