NetWork | ZeroBOX

Network Analysis

IP Address Status Action
121.254.136.9 Active Moloch
164.124.101.2 Active Moloch
193.233.132.62 Active Moloch
34.117.186.192 Active Moloch
GET 200 https://ipinfo.io/widget/demo/175.208.134.152
REQUEST
RESPONSE
GET 200 http://apps.identrust.com/roots/dstrootcax3.p7c
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 193.233.132.62:50500 -> 192.168.56.101:49169 2046266 ET MALWARE [ANY.RUN] RisePro TCP (Token) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 193.233.132.62:50500 2049060 ET MALWARE Suspected RisePro TCP Heartbeat Packet A Network Trojan was detected
TCP 193.233.132.62:50500 -> 192.168.56.101:49169 2046267 ET MALWARE [ANY.RUN] RisePro TCP (External IP) Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.101:49172 -> 34.117.186.192:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 34.117.186.192:443 -> 192.168.56.101:49172 2025330 ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io) Device Retrieving External IP Address Detected
TCP 193.233.132.62:50500 -> 192.168.56.101:49169 2046267 ET MALWARE [ANY.RUN] RisePro TCP (External IP) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 193.233.132.62:50500 2046270 ET MALWARE [ANY.RUN] RisePro TCP (Exfiltration) Malware Command and Control Activity Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.2
192.168.56.101:49172
34.117.186.192:443
C=US, O=Let's Encrypt, CN=R3 CN=ipinfo.io 17:1f:d0:ef:80:aa:6c:99:b1:c4:56:90:ac:2c:8e:3d:e2:0f:6c:c2

Snort Alerts

No Snort Alerts