NetWork | ZeroBOX

Network Analysis

IP Address Status Action
164.124.101.2 Active Moloch
172.67.188.16 Active Moloch
185.172.128.5 Active Moloch
185.172.128.8 Active Moloch
Name Response Post-Analysis Lookup
gatelistcoldyeisa.pw 104.21.7.219

POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
GET 200 http://185.172.128.8/cp.exe
REQUEST
RESPONSE
GET 200 http://185.172.128.8/ma.exe
REQUEST
RESPONSE
GET 200 http://185.172.128.8/ama.exe
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://gatelistcoldyeisa.pw/api
REQUEST
RESPONSE
POST 200 http://185.172.128.5/v8sjh3hs8/index.php
REQUEST
RESPONSE
POST 200 http://185.172.128.5/v8sjh3hs8/index.php?scr=1
REQUEST
RESPONSE
POST 200 http://185.172.128.5/v8sjh3hs8/index.php
REQUEST
RESPONSE
GET 200 http://185.172.128.5/v8sjh3hs8/Plugins/cred64.dll
REQUEST
RESPONSE
POST 200 http://185.172.128.5/v8sjh3hs8/index.php
REQUEST
RESPONSE
GET 200 http://185.172.128.5/v8sjh3hs8/Plugins/clip64.dll
REQUEST
RESPONSE
POST 200 http://185.172.128.5/v8sjh3hs8/index.php
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2016778 ET DNS Query to a *.pw domain - Likely Hostile Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49175 -> 172.67.188.16:80 2048094 ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration Malware Command and Control Activity Detected
TCP 192.168.56.103:49175 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49177 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49165 -> 172.67.188.16:80 2048093 ET MALWARE [ANY.RUN] Win32/Lumma Stealer Check-In Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49165 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49179 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49169 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49182 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49172 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49176 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49187 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49170 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49181 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49166 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49180 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49174 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49184 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49186 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49185 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49193 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49194 -> 185.172.128.8:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49194 -> 185.172.128.8:80 2019714 ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile Potentially Bad Traffic
TCP 192.168.56.103:49168 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49190 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 185.172.128.8:80 -> 192.168.56.103:49194 2014819 ET INFO Packed Executable Download Misc activity
TCP 192.168.56.103:49171 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49173 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 185.172.128.8:80 -> 192.168.56.103:49194 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 185.172.128.8:80 -> 192.168.56.103:49194 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49188 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49192 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49178 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49183 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49189 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49191 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49198 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49201 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49202 -> 172.67.188.16:80 2016777 ET INFO HTTP Request to a *.pw domain Misc activity
TCP 192.168.56.103:49194 -> 185.172.128.8:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49194 -> 185.172.128.8:80 2019714 ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile Potentially Bad Traffic
TCP 192.168.56.103:49194 -> 185.172.128.8:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49194 -> 185.172.128.8:80 2019714 ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile Potentially Bad Traffic
TCP 192.168.56.103:49210 -> 185.172.128.5:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 185.172.128.5:80 -> 192.168.56.103:49210 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 185.172.128.5:80 -> 192.168.56.103:49210 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 192.168.56.103:49212 -> 185.172.128.5:80 2044597 ET MALWARE Amadey Bot Activity (POST) M1 A Network Trojan was detected
TCP 192.168.56.103:49210 -> 185.172.128.5:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts