NetWork | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

latestReport
11.08 05:11
locker.exe
11.08 05:11
PowerView.ps1
11.08 05:11
cred64.dll
11.08 05:11
ngrok.exe
11.08 05:11
CollosalLoader.exe
11.08 05:11
SharpHound.exe
11.08 05:11
Reaper%20cfx%20Spoofer...
11.08 05:11
dxwebsetup.exe
11.08 05:11
hell9o.exe
11.08 05:11
jerniuiopu.exe

Latest News
11.11 05:11
Spam-Anrufe adé: Diese...
11.11 05:11
Bilderkontrolle in Wha...
11.11 05:11
Baguette statt Bitcoin...
11.11 05:11
Beware of the “India P...
11.11 03:11
Component Tester Teardown
11.11 03:11
JPMorgan Braces for ‘I...
11.11 02:11
Zipdump & PKZIP Re...
11.11 12:11
Strom und Heizkosten i...
11.11 12:11
Koffein-Tracking per A...
11.11 12:11
Ryzen 7 9800X3D: AMDs ...

NetWork | ZeroBOX

IP Address	Status	Action
164.124.101.2	Active	Moloch
179.43.183.46	Active	Moloch
193.122.130.0	Active	Moloch
64.185.227.156	Active	Moloch

Name	Response	Post-Analysis Lookup
mail.royalcheckout.store	CNAME royalcheckout.store A 179.43.183.46	179.43.183.46
ftp.royalcheckout.store	CNAME royalcheckout.store A 179.43.183.46	179.43.183.46
softwarez.online
checkip.dyndns.org	A 132.226.8.169 CNAME checkip.dyndns.com A 193.122.130.0 A 132.226.247.73 A 158.101.44.242 A 193.122.6.168	158.101.44.242
api.ipify.org	A 173.231.16.77 A 64.185.227.156 CNAME api4.ipify.org A 104.237.62.212	104.237.62.212

TCP Requests

UDP Requests

GET 200 http://checkip.dyndns.org/

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.101:54148 -> 164.124.101.2:53	2047702	ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup	Misc activity
TCP 179.43.183.46:587 -> 192.168.56.101:49174	2260002	SURICATA Applayer Detect protocol only one direction	Generic Protocol Command Decode
TCP 179.43.183.46:587 -> 192.168.56.101:49174	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49174 -> 179.43.183.46:587	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 64.185.227.156:443 -> 192.168.56.101:49173	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49173 -> 64.185.227.156:443	2047703	ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI	Misc activity
TCP 192.168.56.101:49173 -> 64.185.227.156:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49173 -> 64.185.227.156:443	2047703	ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI	Misc activity
TCP 192.168.56.101:49172 -> 193.122.130.0:80	2021378	ET POLICY External IP Lookup - checkip.dyndns.org	Device Retrieving External IP Address Detected
TCP 192.168.56.101:49172 -> 193.122.130.0:80	2039190	ET INFO 404/Snake/Matiex Keylogger Style External IP Check	Device Retrieving External IP Address Detected
UDP 192.168.56.101:54148 -> 8.8.8.8:53	2047702	ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup	Misc activity
TCP 179.43.183.46:21 -> 192.168.56.101:49175	2260002	SURICATA Applayer Detect protocol only one direction	Generic Protocol Command Decode
UDP 192.168.56.101:59002 -> 164.124.101.2:53	2043238	ET INFO External IP Lookup Domain in DNS Query (checkip .dyndns .org)	Device Retrieving External IP Address Detected
TCP 192.168.56.101:49173 -> 64.185.227.156:443	2047703	ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI	Misc activity

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts