NetWork | ZeroBOX

Network Analysis

IP Address Status Action
121.254.136.18 Active Moloch
164.124.101.2 Active Moloch
172.67.187.200 Active Moloch
172.67.215.45 Active Moloch
192.3.64.154 Active Moloch
GET 200 https://paste.ee/d/qm3k3
REQUEST
RESPONSE
GET 200 http://192.3.64.154/9080/HTMLIEbrowserhistory.vbs
REQUEST
RESPONSE
GET 200 http://apps.identrust.com/roots/dstrootcax3.p7c
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49167 -> 172.67.215.45:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49162 -> 192.3.64.154:80 2027260 ET INFO Dotted Quad Host VBS Request Potentially Bad Traffic
TCP 192.168.56.102:49164 -> 172.67.187.200:443 2034978 ET POLICY Pastebin-style Service (paste .ee) in TLS SNI Potential Corporate Privacy Violation
TCP 192.168.56.102:49164 -> 172.67.187.200:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49167
172.67.215.45:443
C=US, O=Let's Encrypt, CN=E1 CN=uploaddeimagens.com.br d4:47:9f:16:cd:db:0a:99:1e:d8:a8:20:24:9b:c9:bb:4c:62:39:71
TLSv1
192.168.56.102:49164
172.67.187.200:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=paste.ee cd:77:4c:26:1f:f8:63:15:43:5a:ba:aa:11:f1:e7:1a:23:3e:4b:15

Snort Alerts

No Snort Alerts