NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.18.145.235 Active Moloch
104.26.5.15 Active Moloch
164.124.101.2 Active Moloch
193.233.132.74 Active Moloch
34.117.186.192 Active Moloch
GET 200 https://db-ip.com/demo/home.php?s=175.208.134.152
REQUEST
RESPONSE
GET 403 http://www.maxmind.com/geoip/v2.1/city/me
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49168 -> 193.233.132.74:58709 2049060 ET MALWARE RisePro TCP Heartbeat Packet A Network Trojan was detected
TCP 193.233.132.74:58709 -> 192.168.56.101:49168 2046266 ET MALWARE [ANY.RUN] RisePro TCP (Token) A Network Trojan was detected
TCP 192.168.56.101:49170 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.101:49168 -> 193.233.132.74:58709 2046269 ET MALWARE [ANY.RUN] RisePro TCP (Activity) A Network Trojan was detected
TCP 192.168.56.101:49170 -> 34.117.186.192:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 193.233.132.74:58709 -> 192.168.56.101:49168 2046267 ET MALWARE [ANY.RUN] RisePro TCP (External IP) A Network Trojan was detected
TCP 192.168.56.101:49170 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.101:49172 -> 104.26.5.15:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49170 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49172
104.26.5.15:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=db-ip.com 65:b1:27:2e:35:d2:f7:1f:20:04:c5:ca:ea:4e:7a:b4:69:6a:83:00

Snort Alerts

No Snort Alerts