NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.21.92.100 Active Moloch
164.124.101.2 Active Moloch
172.67.163.133 Active Moloch
172.67.75.163 Active Moloch
34.117.59.81 Active Moloch
87.240.129.133 Active Moloch
87.240.190.89 Active Moloch
94.142.138.131 Active Moloch
GET 200 https://api.myip.com/
REQUEST
RESPONSE
GET 200 https://vk.com/doc746114504_647280747?hash=cvDFKP5q0CQEjBCbeoeHvPNrWE0xbMxZEmrkIeNKcET&dl=G42DMMJRGQ2TANA:1661413520:uZNj68vRUvQaydRD8wpAK8zluN0I7otw5AHbA1ZlN9T&api=1&no_preview=1
REQUEST
RESPONSE
GET 302 https://vk.com/doc52355237_667317398?hash=Nzo9Lpy2lnkLk0e9i3sM5Q7Rmhu0skEqTijVFqSmRV4&dl=zTGHW6YEQC0elKjKTCqYaLRzYnULI1fc07ZVd4bICGH&api=1&no_preview=1
REQUEST
RESPONSE
GET 200 https://psv4.userapi.com/c909328/u52355237/docs/d47/c541f110e091/Installation.bmp?extra=UgwBGkMcfjcRXxJpAN_ASDuA0Ulq2C1OYolHMcvZH2Z240wWgFPur2bYY2ipG1c__XCmg7VaCVjAHzDdCrA1S8XNsrR_lsV0QDzjRvhM0brwyhjZhKAOz1A4_7Q9pVPYoNMU8ICt2QCICYFC
REQUEST
RESPONSE
GET 301 https://volkels.fun/api
REQUEST
RESPONSE
GET 200 http://94.142.138.131/api/tracemap.php
REQUEST
RESPONSE
POST 200 http://94.142.138.131/api/firegate.php
REQUEST
RESPONSE
POST 200 http://94.142.138.131/api/firegate.php
REQUEST
RESPONSE
POST 200 http://94.142.138.131/api/firegate.php
REQUEST
RESPONSE
POST 200 http://94.142.138.131/api/firegate.php
REQUEST
RESPONSE
POST 301 http://volkels.fun/api
REQUEST
RESPONSE
POST 200 http://dannyleagy.fun/api
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49172 -> 172.67.75.163:443 2042969 ET INFO Observed External IP Lookup Domain in TLS SNI (api .myip .com) Device Retrieving External IP Address Detected
TCP 192.168.56.102:49172 -> 172.67.75.163:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49177 -> 87.240.129.133:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49177 -> 87.240.129.133:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49171 -> 94.142.138.131:80 2045779 ET MALWARE Win32/BeamWinHTTP CnC Activity M2 (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49180 -> 87.240.129.133:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49183 -> 87.240.129.133:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49183 -> 87.240.129.133:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49178 -> 87.240.129.133:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49187 -> 87.240.129.133:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49185 -> 87.240.129.133:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49188 -> 87.240.190.89:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49173 -> 34.117.59.81:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.102:49173 -> 34.117.59.81:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49173 -> 34.117.59.81:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.102:49176 -> 87.240.129.133:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49176 -> 87.240.129.133:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49184 -> 87.240.129.133:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49184 -> 87.240.129.133:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49192 -> 104.21.92.100:80 2048093 ET MALWARE [ANY.RUN] Win32/Lumma Stealer Check-In Malware Command and Control Activity Detected
TCP 192.168.56.102:49191 -> 172.67.163.133:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49173 -> 34.117.59.81:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49172
172.67.75.163:443
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 92:b4:ed:98:67:d9:db:8a:1e:bd:0e:fe:7f:22:45:e9:79:b5:78:65
TLSv1
192.168.56.102:49180
87.240.129.133:443
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09
TLSv1
192.168.56.102:49187
87.240.129.133:443
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09
TLSv1
192.168.56.102:49188
87.240.190.89:443
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.userapi.com bc:a9:84:5f:86:90:b1:02:ba:2d:66:e8:e5:46:c1:57:e9:c0:cc:24
TLSv1
192.168.56.102:49191
172.67.163.133:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=volkels.fun 96:55:ff:6d:f8:af:51:cf:d2:67:78:f1:8a:d6:58:6e:25:cf:ad:92

Snort Alerts

No Snort Alerts