NetWork | ZeroBOX

Network Analysis

IP Address Status Action
125.253.92.50 Active Moloch
164.124.101.2 Active Moloch
91.92.240.234 Active Moloch
91.92.244.178 Active Moloch
47.76.164.119 Active Moloch
POST 200 http://o7labs.top/visual/skins/index.php
REQUEST
RESPONSE
POST 200 http://o7labs.top/visual/skins/index.php?scr=1
REQUEST
RESPONSE
POST 200 http://o7labs.top/visual/skins/index.php
REQUEST
RESPONSE
GET 200 http://o7labs.top/visual/blob.exe
REQUEST
RESPONSE
POST 200 http://o7labs.top/visual/skins/index.php
REQUEST
RESPONSE
GET 200 http://o7labs.top/visual/build.exe
REQUEST
RESPONSE
POST 200 http://o7labs.top/visual/skins/index.php
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 91.92.240.234:80 -> 192.168.56.103:49165 2400012 ET DROP Spamhaus DROP Listed Traffic Inbound group 13 Misc Attack
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2023883 ET DNS Query to a *.top domain - Likely Hostile Potentially Bad Traffic
TCP 192.168.56.103:49164 -> 91.92.240.234:80 2023882 ET INFO HTTP Request to a *.top domain Potentially Bad Traffic
TCP 192.168.56.103:49166 -> 91.92.240.234:80 2022896 ET HUNTING SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016 A Network Trojan was detected
TCP 192.168.56.103:49172 -> 125.253.92.50:80 2024792 ET POLICY Cryptocurrency Miner Checkin Potential Corporate Privacy Violation
TCP 192.168.56.103:49165 -> 91.92.240.234:80 2044597 ET MALWARE Amadey Bot Activity (POST) M1 A Network Trojan was detected
TCP 91.92.240.234:80 -> 192.168.56.103:49166 2014819 ET INFO Packed Executable Download Misc activity
TCP 91.92.240.234:80 -> 192.168.56.103:49166 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 91.92.240.234:80 -> 192.168.56.103:49166 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 91.92.240.234:80 -> 192.168.56.103:49166 2023464 ET HUNTING Possible EXE Download From Suspicious TLD Misc activity
TCP 192.168.56.103:49166 -> 91.92.240.234:80 2022896 ET HUNTING SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016 A Network Trojan was detected
UDP 192.168.56.103:50800 -> 164.124.101.2:53 2036289 ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro) Crypto Currency Mining Activity Detected
TCP 192.168.56.103:49165 -> 91.92.240.234:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49165 -> 91.92.240.234:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 91.92.244.178:9345 -> 192.168.56.103:49170 2400012 ET DROP Spamhaus DROP Listed Traffic Inbound group 13 Misc Attack
TCP 192.168.56.103:49172 -> 125.253.92.50:80 2024792 ET POLICY Cryptocurrency Miner Checkin Potential Corporate Privacy Violation

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts