NetWork | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

latestReport
08.01 03:08
lasjdflakdsjf.pdf.exe
08.01 03:08
Microsoft_AntiSpam_Ext...
08.01 03:08
hacrvidth vibev.exe
08.01 02:08
vhcrvdh iobv.exe
08.01 02:08
faultrep2.dll
08.01 02:08
faultrep.dll
08.01 02:08
MichelinNight.lnk
08.01 02:08
【算法工程师】李子豪.lnk
08.01 11:08
random.exe
08.01 11:08
dz.js

Latest News
08.02 12:08
Download the Digital W...
08.02 12:08
The cost of (AI) busin...
08.02 12:08
A Simplified Approach ...
08.02 12:08
$75 Million Record-Bre...
08.02 12:08
Over 1 Million Domains...
08.02 12:08
The Kaiser Data Breach...
08.02 12:08
Google Workspace Authe...
08.01 11:08
EU AI Act: Sensible gu...
08.01 11:08
Building Trustworthy A...
08.01 11:08
Info Stealing Campaign...

NetWork | ZeroBOX

IP Address	Status	Action
104.237.62.211	Active	Moloch
107.172.4.162	Active	Moloch
164.124.101.2	Active	Moloch
185.94.230.135	Active	Moloch

Name	Response	Post-Analysis Lookup
mail.telefoonreparatiebovenkarspel.nl	A 185.94.230.135	185.94.230.135
api.ipify.org	A 173.231.16.75 A 64.185.227.156 CNAME api4.ipify.org A 104.237.62.211	104.237.62.211

TCP Requests

UDP Requests

GET 200 http://107.172.4.162/2509/conhost.exe

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.103:52760 -> 164.124.101.2:53	2047702	ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup	Misc activity
TCP 192.168.56.103:49162 -> 107.172.4.162:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 107.172.4.162:80 -> 192.168.56.103:49162	2022050	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1	A Network Trojan was detected
TCP 104.237.62.211:443 -> 192.168.56.103:49167	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.103:49167 -> 104.237.62.211:443	2047703	ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI	Misc activity
TCP 185.94.230.135:587 -> 192.168.56.103:49169	2260002	SURICATA Applayer Detect protocol only one direction	Generic Protocol Command Decode
TCP 192.168.56.103:49167 -> 104.237.62.211:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49167 -> 104.237.62.211:443	2047703	ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI	Misc activity
TCP 192.168.56.103:49169 -> 185.94.230.135:587	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 107.172.4.162:80 -> 192.168.56.103:49162	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 107.172.4.162:80 -> 192.168.56.103:49162	2022051	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2	A Network Trojan was detected
TCP 107.172.4.162:80 -> 192.168.56.103:49162	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
UDP 192.168.56.103:52760 -> 8.8.8.8:53	2047702	ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup	Misc activity
TCP 192.168.56.103:49167 -> 104.237.62.211:443	2047703	ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI	Misc activity

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.2 192.168.56.103:49169 185.94.230.135:587	C=US, ST=TX, L=Houston, O=cPanel, Inc., CN=cPanel, Inc. Certification Authority	CN=telefoonreparatiebovenkarspel.nl	ef:a6:6b:fb:17:ca:0d:c4:ca:6f:8a:f9:97:b8:9a:8c:0e:8e:8d:95

Snort Alerts

No Snort Alerts