NetWork | ZeroBOX

Network Analysis

IP Address Status Action
117.18.232.200 Active Moloch
142.250.199.74 Active Moloch
142.250.207.67 Active Moloch
142.250.66.67 Active Moloch
142.251.222.206 Active Moloch
157.240.215.14 Active Moloch
157.240.215.35 Active Moloch
164.124.101.2 Active Moloch
172.217.24.227 Active Moloch
172.217.24.67 Active Moloch
172.217.25.13 Active Moloch
216.58.200.228 Active Moloch
5.42.92.88 Active Moloch
77.91.124.1 Active Moloch
77.91.124.55 Active Moloch
77.91.68.52 Active Moloch

GET 302 https://accounts.google.com/
REQUEST
RESPONSE
GET 302 https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F
REQUEST
RESPONSE
GET 302 https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeywqvzTXJCBjF9Krz5UewUtmNlhIo1BS8-fexhnyRwXiKcYoKisy5fbyeo0_7MMbPVvKQe3s
REQUEST
RESPONSE
GET 200 https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyyvqedP1KTGaespiPNNUuOOhhlNIWdRWejAZmR61I2VV-ku55l7L8gdnH1EC5fauuzoF1J2fA&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S504171679%3A1697417176414722
REQUEST
RESPONSE
GET 200 https://ssl.gstatic.com/images/branding/googlelogo/2x/googlelogo_color_74x24dp.png
REQUEST
RESPONSE
GET 200 https://accounts.google.com/_/bscframe
REQUEST
RESPONSE
GET 302 https://accounts.google.com/favicon.ico
REQUEST
RESPONSE
GET 204 https://accounts.google.com/generate_204?QoZb0Q
REQUEST
RESPONSE
GET 200 https://www.google.com/favicon.ico
REQUEST
RESPONSE
GET 200 https://www.facebook.com/login
REQUEST
RESPONSE
GET 302 https://www.youtube.com/
REQUEST
RESPONSE
GET 200 https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2F
REQUEST
RESPONSE
GET 200 https://static.xx.fbcdn.net/rsrc.php/v3/yi/l/0,cross/s3epWMBo1FX.css?_nc_x=Ij3Wp8lg5Kz
REQUEST
RESPONSE
GET 200 https://static.xx.fbcdn.net/rsrc.php/v3/yr/l/0,cross/u4xvA0Tw-4L.css?_nc_x=Ij3Wp8lg5Kz
REQUEST
RESPONSE
GET 200 https://static.xx.fbcdn.net/rsrc.php/v3/yH/l/0,cross/zDdQsF0sOjp.css?_nc_x=Ij3Wp8lg5Kz
REQUEST
RESPONSE
GET 200 https://static.xx.fbcdn.net/rsrc.php/v3/yV/l/0,cross/om552iOCRxJ.css?_nc_x=Ij3Wp8lg5Kz
REQUEST
RESPONSE
GET 200 https://static.xx.fbcdn.net/rsrc.php/v3/ye/l/0,cross/seCHURQhRK2.css?_nc_x=Ij3Wp8lg5Kz
REQUEST
RESPONSE
GET 200 https://static.xx.fbcdn.net/rsrc.php/yI/r/4aAhOWlwaXf.svg
REQUEST
RESPONSE
GET 200 https://static.xx.fbcdn.net/rsrc.php/v3/yc/l/0,cross/1FPNULrhhBJ.css?_nc_x=Ij3Wp8lg5Kz
REQUEST
RESPONSE
GET 200 https://static.xx.fbcdn.net/rsrc.php/v3/yB/l/0,cross/qz5m5ZNj4YA.css?_nc_x=Ij3Wp8lg5Kz
REQUEST
RESPONSE
GET 200 https://static.xx.fbcdn.net/rsrc.php/v3/ya/r/v2fcQEWFLez.js?_nc_x=Ij3Wp8lg5Kz
REQUEST
RESPONSE
GET 200 https://fonts.googleapis.com/css?family=YouTube+Sans:500
REQUEST
RESPONSE
GET 200 https://fonts.googleapis.com/css?family=Roboto:400,500
REQUEST
RESPONSE
GET 200 https://www.youtube.com/img/desktop/supported_browsers/yt_logo_rgb_light.png
REQUEST
RESPONSE
GET 200 https://www.youtube.com/img/desktop/supported_browsers/dinosaur.png
REQUEST
RESPONSE
GET 200 https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxM.woff
REQUEST
RESPONSE
GET 200 https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc-.woff
REQUEST
RESPONSE
GET 302 https://accounts.google.com/
REQUEST
RESPONSE
GET 302 https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F
REQUEST
RESPONSE
GET 200 https://www.youtube.com/img/desktop/supported_browsers/firefox.png
REQUEST
RESPONSE
GET 200 https://www.youtube.com/img/desktop/supported_browsers/opera.png
REQUEST
RESPONSE
GET 200 https://fonts.gstatic.com/s/youtubesans/v19/Qw3hZQNGEDjaO2m6tqIqX5E-AVS5_rSejo46_PCTRspJ0OosolrBEJL3HMXfxQASluL2m_dANVawBpSF.woff
REQUEST
RESPONSE
GET 302 https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyzBQFfM-zgimivF77SXFn_CtNlk_Zx-KTSJ1hmwlPAI3lcCA3Htt7SepazY5A750yWTYAOAag
REQUEST
RESPONSE
GET 302 https://facebook.com/security/hsts-pixel.gif?c=3.2.5
REQUEST
RESPONSE
GET 200 https://www.youtube.com/img/desktop/supported_browsers/chrome.png
REQUEST
RESPONSE
GET 200 https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyz6pDefJyKshYFsDLzJUIYEkQBxjlzW7Psw7k8R--D2gwUfEF8gBSj8fOPfztqQKz1zgy7RqQ&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S-419032450%3A1697417189597662
REQUEST
RESPONSE
GET 200 https://www.youtube.com/img/desktop/supported_browsers/edgium.png
REQUEST
RESPONSE
GET 200 https://www.youtube.com/favicon.ico
REQUEST
RESPONSE
GET 302 https://fbcdn.net/security/hsts-pixel.gif?c=2.5
REQUEST
RESPONSE
GET 302 https://fbsbx.com/security/hsts-pixel.gif?c=5
REQUEST
RESPONSE
GET 200 https://ssl.gstatic.com/images/branding/googlelogo/2x/googlelogo_color_74x24dp.png
REQUEST
RESPONSE
GET 200 https://connect.facebook.net/security/hsts-pixel.gif
REQUEST
RESPONSE
GET 200 https://static.xx.fbcdn.net/rsrc.php/v3/yB/r/Y0L6f5sxdIV.png
REQUEST
RESPONSE
GET 200 https://static.xx.fbcdn.net/rsrc.php/v3/yU/r/O7nelmd9XSI.png
REQUEST
RESPONSE
GET 200 https://static.xx.fbcdn.net/rsrc.php/v3imQ-4/yl/l/ko_KR/CdEEViHRUhC.js?_nc_x=Ij3Wp8lg5Kz
REQUEST
RESPONSE
GET 0 https://accounts.google.com/_/bscframe
REQUEST
RESPONSE
GET 200 https://static.xx.fbcdn.net/rsrc.php/v3/yG/r/rAl2Hl1fQTa.js?_nc_x=Ij3Wp8lg5Kz
REQUEST
RESPONSE
GET 200 https://www.facebook.com/favicon.ico
REQUEST
RESPONSE
GET 204 https://accounts.google.com/generate_204?6JaKqw
REQUEST
RESPONSE
GET 200 https://www.facebook.com/login
REQUEST
RESPONSE
GET 304 https://static.xx.fbcdn.net/rsrc.php/v3/yr/l/0,cross/u4xvA0Tw-4L.css?_nc_x=Ij3Wp8lg5Kz
REQUEST
RESPONSE
GET 304 https://static.xx.fbcdn.net/rsrc.php/v3/yi/l/0,cross/s3epWMBo1FX.css?_nc_x=Ij3Wp8lg5Kz
REQUEST
RESPONSE
GET 304 https://static.xx.fbcdn.net/rsrc.php/v3/yB/l/0,cross/qz5m5ZNj4YA.css?_nc_x=Ij3Wp8lg5Kz
REQUEST
RESPONSE
GET 304 https://static.xx.fbcdn.net/rsrc.php/v3/yV/l/0,cross/om552iOCRxJ.css?_nc_x=Ij3Wp8lg5Kz
REQUEST
RESPONSE
GET 304 https://static.xx.fbcdn.net/rsrc.php/v3/yc/l/0,cross/1FPNULrhhBJ.css?_nc_x=Ij3Wp8lg5Kz
REQUEST
RESPONSE
GET 304 https://static.xx.fbcdn.net/rsrc.php/v3/yH/l/0,cross/zDdQsF0sOjp.css?_nc_x=Ij3Wp8lg5Kz
REQUEST
RESPONSE
GET 304 https://static.xx.fbcdn.net/rsrc.php/v3/ya/r/v2fcQEWFLez.js?_nc_x=Ij3Wp8lg5Kz
REQUEST
RESPONSE
GET 304 https://static.xx.fbcdn.net/rsrc.php/yI/r/4aAhOWlwaXf.svg
REQUEST
RESPONSE
GET 304 https://static.xx.fbcdn.net/rsrc.php/v3/ye/l/0,cross/seCHURQhRK2.css?_nc_x=Ij3Wp8lg5Kz
REQUEST
RESPONSE
GET 302 https://facebook.com/security/hsts-pixel.gif?c=3.2.5
REQUEST
RESPONSE
GET 302 https://fbcdn.net/security/hsts-pixel.gif?c=2.5
REQUEST
RESPONSE
GET 302 https://fbsbx.com/security/hsts-pixel.gif?c=5
REQUEST
RESPONSE
GET 200 https://connect.facebook.net/security/hsts-pixel.gif
REQUEST
RESPONSE
GET 302 https://accounts.google.com/
REQUEST
RESPONSE
GET 0 https://www.youtube.com/
REQUEST
RESPONSE
GET 0 https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F
REQUEST
RESPONSE
GET 200 https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2F
REQUEST
RESPONSE
GET 302 https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyw4RWVwonSQV9wc-sJ0hblW9eUgDp1jATZxto4xsZPzcpyg4ePyDYNLFo8tESUhKgBEKv4xqw
REQUEST
RESPONSE
GET 0 https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeywF-mDMSOkEjswyonfbOEtS8T9hact2vcwHgZZt-ZnDN2gujzOMIGtK2wUeYYtVpRN3jXclQg&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S50465221%3A1697417225539467
REQUEST
RESPONSE
GET 200 https://fonts.googleapis.com/css?family=YouTube+Sans:500
REQUEST
RESPONSE
GET 200 https://ssl.gstatic.com/images/branding/googlelogo/2x/googlelogo_color_74x24dp.png
REQUEST
RESPONSE
GET 200 https://accounts.google.com/_/bscframe
REQUEST
RESPONSE
GET 304 https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc-.woff
REQUEST
RESPONSE
GET 304 https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxM.woff
REQUEST
RESPONSE
GET 0 https://accounts.google.com/generate_204?hKrxwg
REQUEST
RESPONSE
POST 200 http://5.42.92.88/loghub/master
REQUEST
RESPONSE
POST 200 http://5.42.92.88/loghub/master
REQUEST
RESPONSE
POST 200 http://5.42.92.88/loghub/master
REQUEST
RESPONSE
POST 200 http://5.42.92.88/loghub/master
REQUEST
RESPONSE
POST 200 http://5.42.92.88/loghub/master
REQUEST
RESPONSE
POST 200 http://5.42.92.88/loghub/master
REQUEST
RESPONSE
POST 200 http://5.42.92.88/loghub/master
REQUEST
RESPONSE
POST 200 http://5.42.92.88/loghub/master
REQUEST
RESPONSE
POST 200 http://5.42.92.88/loghub/master
REQUEST
RESPONSE
POST 200 http://5.42.92.88/loghub/master
REQUEST
RESPONSE
POST 200 http://5.42.92.88/loghub/master
REQUEST
RESPONSE
POST 200 http://5.42.92.88/loghub/master
REQUEST
RESPONSE
POST 200 http://77.91.124.1/theme/index.php
REQUEST
RESPONSE
POST 200 http://5.42.92.88/loghub/master
REQUEST
RESPONSE
GET 200 http://77.91.68.52/fuza/2.ps1
REQUEST
RESPONSE
POST 200 http://77.91.124.1/theme/index.php
REQUEST
RESPONSE
GET 200 http://77.91.68.52/fuza/sus.exe
REQUEST
RESPONSE
POST 200 http://77.91.124.1/theme/index.php
REQUEST
RESPONSE
GET 200 http://77.91.68.52/fuza/foto2552.exe
REQUEST
RESPONSE
POST 200 http://77.91.124.1/theme/index.php
REQUEST
RESPONSE
GET 200 http://77.91.68.52/fuza/nalo.exe
REQUEST
RESPONSE
POST 200 http://77.91.124.1/theme/index.php
REQUEST
RESPONSE
POST 200 http://5.42.92.88/loghub/master
REQUEST
RESPONSE
POST 200 http://5.42.92.88/loghub/master
REQUEST
RESPONSE
POST 200 http://5.42.92.88/loghub/master
REQUEST
RESPONSE
GET 404 http://77.91.124.1/theme/Plugins/cred64.dll
REQUEST
RESPONSE
GET 200 http://77.91.124.1/theme/Plugins/clip64.dll
REQUEST
RESPONSE
GET 200 http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49171 -> 77.91.124.55:19071 2043233 ET INFO Microsoft net.tcp Connection Initialization Activity Potentially Bad Traffic
TCP 192.168.56.103:49172 -> 5.42.92.88:80 2018358 ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1 Potentially Bad Traffic
TCP 192.168.56.103:49170 -> 5.42.92.88:80 2047625 ET MALWARE [ANY.RUN] Win32/Stealc Checkin (POST) A Network Trojan was detected
TCP 192.168.56.103:49170 -> 5.42.92.88:80 2018358 ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1 Potentially Bad Traffic
TCP 192.168.56.103:49172 -> 5.42.92.88:80 2018358 ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1 Potentially Bad Traffic
TCP 192.168.56.103:49170 -> 5.42.92.88:80 2018358 ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1 Potentially Bad Traffic
TCP 192.168.56.103:49170 -> 5.42.92.88:80 2018358 ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1 Potentially Bad Traffic
TCP 192.168.56.103:49171 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49171 -> 77.91.124.55:19071 2046045 ET MALWARE [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization) A Network Trojan was detected
TCP 77.91.124.55:19071 -> 192.168.56.103:49171 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response A Network Trojan was detected
TCP 192.168.56.103:49171 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49171 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49171 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49171 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49171 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49171 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49171 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49171 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49171 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49171 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49171 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49188 -> 5.42.92.88:80 2018358 ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1 Potentially Bad Traffic
TCP 192.168.56.103:49171 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49171 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49171 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49171 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49171 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49171 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49171 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49171 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49171 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49189 -> 77.91.68.52:80 2032162 ET INFO PS1 Powershell File Request Potentially Bad Traffic
TCP 192.168.56.103:49189 -> 77.91.68.52:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49189 -> 77.91.68.52:80 2019714 ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile Potentially Bad Traffic
TCP 77.91.68.52:80 -> 192.168.56.103:49189 2014819 ET INFO Packed Executable Download Misc activity
TCP 77.91.68.52:80 -> 192.168.56.103:49189 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 77.91.68.52:80 -> 192.168.56.103:49189 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 77.91.68.52:80 -> 192.168.56.103:49189 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49216 -> 172.217.25.13:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49215 -> 172.217.25.13:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49226 -> 5.42.92.88:80 2018358 ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1 Potentially Bad Traffic
TCP 192.168.56.103:49189 -> 77.91.68.52:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49235 -> 77.91.124.55:19071 2043233 ET INFO Microsoft net.tcp Connection Initialization Activity Potentially Bad Traffic
TCP 192.168.56.103:49221 -> 172.217.24.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49246 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49247 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49242 -> 142.251.222.206:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49243 -> 142.251.222.206:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 77.91.68.52:80 -> 192.168.56.103:49189 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 77.91.68.52:80 -> 192.168.56.103:49189 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49245 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49172 -> 5.42.92.88:80 2018358 ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1 Potentially Bad Traffic
TCP 192.168.56.103:49236 -> 216.58.200.228:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49250 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49172 -> 5.42.92.88:80 2018358 ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1 Potentially Bad Traffic
TCP 192.168.56.103:49269 -> 157.240.215.35:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49249 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49273 -> 157.240.215.35:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49255 -> 142.250.199.74:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49275 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49254 -> 142.250.199.74:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49257 -> 142.250.207.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49259 -> 142.250.207.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49262 -> 172.217.25.13:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49303 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49265 -> 142.251.222.206:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49266 -> 157.240.215.35:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49267 -> 157.240.215.35:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49271 -> 172.217.24.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49276 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49285 -> 5.42.92.88:80 2018358 ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1 Potentially Bad Traffic
TCP 192.168.56.103:49235 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49235 -> 77.91.124.55:19071 2046045 ET MALWARE [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization) A Network Trojan was detected
TCP 77.91.124.55:19071 -> 192.168.56.103:49235 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response A Network Trojan was detected
TCP 192.168.56.103:49235 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49235 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49235 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49299 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49235 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49235 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49235 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49235 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49264 -> 142.251.222.206:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49302 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49305 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49272 -> 157.240.215.35:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49235 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49235 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49235 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49235 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49235 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49235 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49235 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49235 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49307 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49235 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49317 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49235 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49235 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49235 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49235 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49322 -> 172.217.25.13:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49311 -> 157.240.215.35:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49300 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49329 -> 172.217.24.227:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49287 -> 77.91.124.1:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49309 -> 157.240.215.35:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49330 -> 172.217.24.227:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49287 -> 77.91.124.1:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49323 -> 172.217.25.13:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 77.91.124.1:80 -> 192.168.56.103:49287 2014819 ET INFO Packed Executable Download Misc activity
TCP 192.168.56.103:49290 -> 77.91.124.55:19071 2043233 ET INFO Microsoft net.tcp Connection Initialization Activity Potentially Bad Traffic
TCP 192.168.56.103:49172 -> 5.42.92.88:80 2018358 ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1 Potentially Bad Traffic
TCP 77.91.124.1:80 -> 192.168.56.103:49287 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 77.91.124.1:80 -> 192.168.56.103:49287 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 192.168.56.103:49313 -> 157.240.215.35:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49327 -> 142.250.199.74:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49297 -> 157.240.215.35:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49333 -> 142.250.66.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49328 -> 142.250.199.74:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49332 -> 142.250.66.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 77.91.124.1:80 -> 192.168.56.103:49287 2015744 ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging) Misc activity
TCP 192.168.56.103:49331 -> 142.250.66.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49304 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49306 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49316 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49290 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49290 -> 77.91.124.55:19071 2046045 ET MALWARE [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization) A Network Trojan was detected
TCP 77.91.124.55:19071 -> 192.168.56.103:49290 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response A Network Trojan was detected
TCP 192.168.56.103:49324 -> 142.251.222.206:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49290 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49290 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49290 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49290 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49290 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49290 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49290 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49290 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49290 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49290 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49290 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49290 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49290 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49290 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49290 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49290 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49290 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49290 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49290 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49290 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49189 -> 77.91.68.52:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49172 -> 5.42.92.88:80 2018358 ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1 Potentially Bad Traffic
TCP 192.168.56.103:49172 -> 5.42.92.88:80 2018358 ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1 Potentially Bad Traffic
TCP 192.168.56.103:49222 -> 172.217.24.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49172 -> 5.42.92.88:80 2018358 ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1 Potentially Bad Traffic
TCP 192.168.56.103:49240 -> 157.240.215.35:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49239 -> 157.240.215.35:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49253 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49268 -> 157.240.215.35:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49270 -> 172.217.24.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49310 -> 157.240.215.35:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49314 -> 157.240.215.35:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49325 -> 142.251.222.206:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49172 -> 5.42.92.88:80 2018358 ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1 Potentially Bad Traffic
TCP 192.168.56.103:49186 -> 77.91.124.1:80 2027700 ET MALWARE Amadey CnC Check-In Malware Command and Control Activity Detected
TCP 192.168.56.103:49186 -> 77.91.124.1:80 2045751 ET MALWARE Win32/Amadey Bot Activity (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49186 -> 77.91.124.1:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49186 -> 77.91.124.1:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49186 -> 77.91.124.1:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49203 -> 77.91.124.55:19071 2043233 ET INFO Microsoft net.tcp Connection Initialization Activity Potentially Bad Traffic
TCP 192.168.56.103:49203 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49203 -> 77.91.124.55:19071 2046045 ET MALWARE [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization) A Network Trojan was detected
TCP 192.168.56.103:49186 -> 77.91.124.1:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 77.91.124.55:19071 -> 192.168.56.103:49203 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response A Network Trojan was detected
TCP 192.168.56.103:49203 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49233 -> 5.42.92.88:80 2018358 ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1 Potentially Bad Traffic
TCP 192.168.56.103:49203 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49237 -> 216.58.200.228:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49244 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49248 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49251 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49252 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49258 -> 142.250.207.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49261 -> 172.217.25.13:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49203 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49203 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49203 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49203 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49203 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49203 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49203 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49203 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49203 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49203 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49203 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49203 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49203 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49203 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49203 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49203 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49203 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49203 -> 77.91.124.55:19071 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49296 -> 157.240.215.35:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49298 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49301 -> 157.240.215.14:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49312 -> 157.240.215.35:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49215
172.217.25.13:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=accounts.google.com 4a:5a:3c:9d:ec:4d:02:20:de:b6:76:11:1c:40:b5:78:e9:aa:a6:0d
TLSv1
192.168.56.103:49221
172.217.24.67:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.gstatic.com 24:e0:20:dc:de:e3:a8:d9:a8:17:ba:26:f5:41:32:19:98:d0:30:f3
TLSv1
192.168.56.103:49216
172.217.25.13:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=accounts.google.com 4a:5a:3c:9d:ec:4d:02:20:de:b6:76:11:1c:40:b5:78:e9:aa:a6:0d
TLSv1
192.168.56.103:49246
157.240.215.14:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com e4:f4:1f:ec:36:38:21:65:ee:b4:e0:ea:11:66:d9:36:2a:f3:d9:18
TLSv1
192.168.56.103:49247
157.240.215.14:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com e4:f4:1f:ec:36:38:21:65:ee:b4:e0:ea:11:66:d9:36:2a:f3:d9:18
TLSv1
192.168.56.103:49242
142.251.222.206:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.google.com 09:1e:68:9f:bd:40:4b:47:8d:ac:be:fe:ef:35:d6:52:c1:a0:ec:9f
TLSv1
192.168.56.103:49243
142.251.222.206:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.google.com 09:1e:68:9f:bd:40:4b:47:8d:ac:be:fe:ef:35:d6:52:c1:a0:ec:9f
TLSv1
192.168.56.103:49245
157.240.215.14:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com e4:f4:1f:ec:36:38:21:65:ee:b4:e0:ea:11:66:d9:36:2a:f3:d9:18
TLSv1
192.168.56.103:49236
216.58.200.228:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=www.google.com c9:f6:98:54:a9:56:99:75:0a:10:b7:bd:95:70:40:74:3a:b0:b0:77
TLSv1
192.168.56.103:49250
157.240.215.14:443
None None None
TLSv1
192.168.56.103:49269
157.240.215.35:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=fbcdn.net 04:f1:7c:55:c3:7e:a3:bf:72:72:37:75:24:a0:6a:89:af:bd:19:ed
TLSv1
192.168.56.103:49249
157.240.215.14:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com e4:f4:1f:ec:36:38:21:65:ee:b4:e0:ea:11:66:d9:36:2a:f3:d9:18
TLSv1
192.168.56.103:49273
157.240.215.35:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=fbcdn.net 04:f1:7c:55:c3:7e:a3:bf:72:72:37:75:24:a0:6a:89:af:bd:19:ed
TLSv1
192.168.56.103:49275
157.240.215.14:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com e4:f4:1f:ec:36:38:21:65:ee:b4:e0:ea:11:66:d9:36:2a:f3:d9:18
TLSv1
192.168.56.103:49255
142.250.199.74:443
None None None
TLSv1
192.168.56.103:49254
142.250.199.74:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=upload.video.google.com 73:c0:b4:ab:41:0a:6a:68:d4:ae:ee:e2:11:a4:38:23:ef:d2:86:b7
TLSv1
192.168.56.103:49257
142.250.207.67:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.gstatic.com 24:e0:20:dc:de:e3:a8:d9:a8:17:ba:26:f5:41:32:19:98:d0:30:f3
TLSv1
192.168.56.103:49259
142.250.207.67:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.gstatic.com 24:e0:20:dc:de:e3:a8:d9:a8:17:ba:26:f5:41:32:19:98:d0:30:f3
TLSv1
192.168.56.103:49262
172.217.25.13:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=accounts.google.com 4a:5a:3c:9d:ec:4d:02:20:de:b6:76:11:1c:40:b5:78:e9:aa:a6:0d
TLSv1
192.168.56.103:49265
142.251.222.206:443
None None None
TLSv1
192.168.56.103:49267
157.240.215.35:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com e4:f4:1f:ec:36:38:21:65:ee:b4:e0:ea:11:66:d9:36:2a:f3:d9:18
TLSv1
192.168.56.103:49271
172.217.24.67:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.gstatic.com 24:e0:20:dc:de:e3:a8:d9:a8:17:ba:26:f5:41:32:19:98:d0:30:f3
TLSv1
192.168.56.103:49276
157.240.215.14:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com e4:f4:1f:ec:36:38:21:65:ee:b4:e0:ea:11:66:d9:36:2a:f3:d9:18
TLSv1
192.168.56.103:49299
157.240.215.14:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com e4:f4:1f:ec:36:38:21:65:ee:b4:e0:ea:11:66:d9:36:2a:f3:d9:18
TLSv1
192.168.56.103:49266
157.240.215.35:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com e4:f4:1f:ec:36:38:21:65:ee:b4:e0:ea:11:66:d9:36:2a:f3:d9:18
TLSv1
192.168.56.103:49303
157.240.215.14:443
None None None
TLSv1
192.168.56.103:49264
142.251.222.206:443
None None None
TLSv1
192.168.56.103:49272
157.240.215.35:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=fbcdn.net 04:f1:7c:55:c3:7e:a3:bf:72:72:37:75:24:a0:6a:89:af:bd:19:ed
TLSv1
192.168.56.103:49302
157.240.215.14:443
None None None
TLSv1
192.168.56.103:49307
157.240.215.14:443
None None None
TLSv1
192.168.56.103:49317
157.240.215.14:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com e4:f4:1f:ec:36:38:21:65:ee:b4:e0:ea:11:66:d9:36:2a:f3:d9:18
TLSv1
192.168.56.103:49305
157.240.215.14:443
None None None
TLSv1
192.168.56.103:49322
172.217.25.13:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=accounts.google.com 4a:5a:3c:9d:ec:4d:02:20:de:b6:76:11:1c:40:b5:78:e9:aa:a6:0d
TLSv1
192.168.56.103:49311
157.240.215.35:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=fbcdn.net 04:f1:7c:55:c3:7e:a3:bf:72:72:37:75:24:a0:6a:89:af:bd:19:ed
TLSv1
192.168.56.103:49300
157.240.215.14:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com e4:f4:1f:ec:36:38:21:65:ee:b4:e0:ea:11:66:d9:36:2a:f3:d9:18
TLSv1
192.168.56.103:49329
172.217.24.227:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.gstatic.com 24:e0:20:dc:de:e3:a8:d9:a8:17:ba:26:f5:41:32:19:98:d0:30:f3
TLSv1
192.168.56.103:49309
157.240.215.35:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com e4:f4:1f:ec:36:38:21:65:ee:b4:e0:ea:11:66:d9:36:2a:f3:d9:18
TLSv1
192.168.56.103:49330
172.217.24.227:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.gstatic.com 24:e0:20:dc:de:e3:a8:d9:a8:17:ba:26:f5:41:32:19:98:d0:30:f3
TLSv1
192.168.56.103:49323
172.217.25.13:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=accounts.google.com 4a:5a:3c:9d:ec:4d:02:20:de:b6:76:11:1c:40:b5:78:e9:aa:a6:0d
TLSv1
192.168.56.103:49313
157.240.215.35:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=fbcdn.net 04:f1:7c:55:c3:7e:a3:bf:72:72:37:75:24:a0:6a:89:af:bd:19:ed
TLSv1
192.168.56.103:49327
142.250.199.74:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=upload.video.google.com 73:c0:b4:ab:41:0a:6a:68:d4:ae:ee:e2:11:a4:38:23:ef:d2:86:b7
TLSv1
192.168.56.103:49297
157.240.215.35:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com e4:f4:1f:ec:36:38:21:65:ee:b4:e0:ea:11:66:d9:36:2a:f3:d9:18
TLSv1
192.168.56.103:49333
142.250.66.67:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.gstatic.com 24:e0:20:dc:de:e3:a8:d9:a8:17:ba:26:f5:41:32:19:98:d0:30:f3
TLSv1
192.168.56.103:49328
142.250.199.74:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=upload.video.google.com 73:c0:b4:ab:41:0a:6a:68:d4:ae:ee:e2:11:a4:38:23:ef:d2:86:b7
TLSv1
192.168.56.103:49332
142.250.66.67:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.gstatic.com 24:e0:20:dc:de:e3:a8:d9:a8:17:ba:26:f5:41:32:19:98:d0:30:f3
TLSv1
192.168.56.103:49331
142.250.66.67:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.gstatic.com 24:e0:20:dc:de:e3:a8:d9:a8:17:ba:26:f5:41:32:19:98:d0:30:f3
TLSv1
192.168.56.103:49304
157.240.215.14:443
None None None
TLSv1
192.168.56.103:49306
157.240.215.14:443
None None None
TLSv1
192.168.56.103:49316
157.240.215.14:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com e4:f4:1f:ec:36:38:21:65:ee:b4:e0:ea:11:66:d9:36:2a:f3:d9:18
TLSv1
192.168.56.103:49324
142.251.222.206:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.google.com 09:1e:68:9f:bd:40:4b:47:8d:ac:be:fe:ef:35:d6:52:c1:a0:ec:9f
TLSv1
192.168.56.103:49222
172.217.24.67:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.gstatic.com 24:e0:20:dc:de:e3:a8:d9:a8:17:ba:26:f5:41:32:19:98:d0:30:f3
TLSv1
192.168.56.103:49240
157.240.215.35:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com e4:f4:1f:ec:36:38:21:65:ee:b4:e0:ea:11:66:d9:36:2a:f3:d9:18
TLSv1
192.168.56.103:49239
157.240.215.35:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com e4:f4:1f:ec:36:38:21:65:ee:b4:e0:ea:11:66:d9:36:2a:f3:d9:18
TLSv1
192.168.56.103:49253
157.240.215.14:443
None None None
TLSv1
192.168.56.103:49268
157.240.215.35:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=fbcdn.net 04:f1:7c:55:c3:7e:a3:bf:72:72:37:75:24:a0:6a:89:af:bd:19:ed
TLSv1
192.168.56.103:49270
172.217.24.67:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.gstatic.com 24:e0:20:dc:de:e3:a8:d9:a8:17:ba:26:f5:41:32:19:98:d0:30:f3
TLSv1
192.168.56.103:49310
157.240.215.35:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com e4:f4:1f:ec:36:38:21:65:ee:b4:e0:ea:11:66:d9:36:2a:f3:d9:18
TLSv1
192.168.56.103:49314
157.240.215.35:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=fbcdn.net 04:f1:7c:55:c3:7e:a3:bf:72:72:37:75:24:a0:6a:89:af:bd:19:ed
TLSv1
192.168.56.103:49325
142.251.222.206:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.google.com 09:1e:68:9f:bd:40:4b:47:8d:ac:be:fe:ef:35:d6:52:c1:a0:ec:9f
TLSv1
192.168.56.103:49237
216.58.200.228:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=www.google.com c9:f6:98:54:a9:56:99:75:0a:10:b7:bd:95:70:40:74:3a:b0:b0:77
TLSv1
192.168.56.103:49244
157.240.215.14:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com e4:f4:1f:ec:36:38:21:65:ee:b4:e0:ea:11:66:d9:36:2a:f3:d9:18
TLSv1
192.168.56.103:49248
157.240.215.14:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com e4:f4:1f:ec:36:38:21:65:ee:b4:e0:ea:11:66:d9:36:2a:f3:d9:18
TLSv1
192.168.56.103:49251
157.240.215.14:443
None None None
TLSv1
192.168.56.103:49252
157.240.215.14:443
None None None
TLSv1
192.168.56.103:49258
142.250.207.67:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.gstatic.com 24:e0:20:dc:de:e3:a8:d9:a8:17:ba:26:f5:41:32:19:98:d0:30:f3
TLSv1
192.168.56.103:49261
172.217.25.13:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=accounts.google.com 4a:5a:3c:9d:ec:4d:02:20:de:b6:76:11:1c:40:b5:78:e9:aa:a6:0d
TLSv1
192.168.56.103:49296
157.240.215.35:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com e4:f4:1f:ec:36:38:21:65:ee:b4:e0:ea:11:66:d9:36:2a:f3:d9:18
TLSv1
192.168.56.103:49298
157.240.215.14:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com e4:f4:1f:ec:36:38:21:65:ee:b4:e0:ea:11:66:d9:36:2a:f3:d9:18
TLSv1
192.168.56.103:49301
157.240.215.14:443
None None None
TLSv1
192.168.56.103:49312
157.240.215.35:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=fbcdn.net 04:f1:7c:55:c3:7e:a3:bf:72:72:37:75:24:a0:6a:89:af:bd:19:ed

Snort Alerts

No Snort Alerts