NetWork | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

latestReport
11.13 04:11
hello.exe
11.13 03:11
espsemhvcioff.exe
11.13 02:11
Geek_se.exe
11.13 02:11
cred64.dll
11.13 02:11
svhost.exe
11.13 02:11
nb.exe
11.13 02:11
svcyr.exe
11.13 02:11
Ghost_1.5.11.5.exe
11.13 02:11
PowderGpl.exe
11.13 02:11
goodlabel%E6%89%93%E5%...

Latest News
11.14 10:11
윈도우 10,윈도우 11 kb504661...
11.14 10:11
Scammer robs homebuyer...
11.14 10:11
Europol supports EPPO-...
11.14 10:11
Here’s how misconfigur...
11.14 10:11
Scammer robs homebuyer...
11.14 10:11
Inside Intelligence Ce...
11.14 10:11
“Free Hugs” – What To ...
11.14 10:11
Parcel-Locker Billiona...
11.14 09:11
5 BCDR Oversights That...
11.14 09:11
Meta’s Week of Setback...

NetWork | ZeroBOX

IP Address	Status	Action
104.26.12.205	Active	Moloch
114.108.166.82	Active	Moloch
164.124.101.2	Active	Moloch
172.67.75.172	Active	Moloch
185.38.142.10	Active	Moloch
34.117.186.192	Active	Moloch

Name	Response	Post-Analysis Lookup
apps.identrust.com	A 114.108.166.96 CNAME a1952.dscq.akamai.net CNAME identrust.edgesuite.net A 114.108.166.82	23.44.173.97
ipinfo.io	A 34.117.186.192	34.117.186.192
api.ip.sb	CNAME api.ip.sb.cdn.cloudflare.net A 104.26.13.31 A 104.26.12.31 A 172.67.75.172	104.26.13.31
api.ipify.org	A 104.26.13.205 A 172.67.74.152 A 104.26.12.205	172.67.74.152

TCP Requests

UDP Requests

GET 200 http://apps.identrust.com/roots/dstrootcax3.p7c

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49169 -> 104.26.12.205:443	2047703	ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI	Misc activity
TCP 192.168.56.103:49169 -> 104.26.12.205:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49169 -> 104.26.12.205:443	2047703	ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI	Misc activity
TCP 192.168.56.103:49166 -> 172.67.75.172:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
UDP 192.168.56.103:53673 -> 164.124.101.2:53	2047702	ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup	Misc activity
TCP 192.168.56.103:49168 -> 34.117.186.192:443	2025331	ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)	Device Retrieving External IP Address Detected
TCP 192.168.56.103:49168 -> 34.117.186.192:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49168 -> 34.117.186.192:443	2025331	ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)	Device Retrieving External IP Address Detected
UDP 192.168.56.103:53673 -> 8.8.8.8:53	2047702	ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup	Misc activity
TCP 185.38.142.10:7474 -> 192.168.56.103:49165	2045000	ET MALWARE RedLine Stealer - CheckConnect Response	Malware Command and Control Activity Detected
TCP 185.38.142.10:7474 -> 192.168.56.103:49165	2045001	ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound	Malware Command and Control Activity Detected
TCP 185.38.142.10:7474 -> 192.168.56.103:49165	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	A Network Trojan was detected
TCP 185.38.142.10:7474 -> 192.168.56.103:49165	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 192.168.56.103:49169 -> 104.26.12.205:443	2047703	ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI	Misc activity
TCP 192.168.56.103:49168 -> 34.117.186.192:443	2025331	ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)	Device Retrieving External IP Address Detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49166 172.67.75.172:443	C=US, O=Let's Encrypt, CN=R3	CN=api.ip.sb	56:08:4c:28:1c:71:43:01:67:cb:24:7f:37:f3:f9:bd:5d:e1:9b:93

Snort Alerts

No Snort Alerts