NetWork | ZeroBOX

Network Analysis

IP Address Status Action
131.255.215.165 Active Moloch
164.124.101.2 Active Moloch
172.67.139.220 Active Moloch
GET 200 https://api.2ip.ua/geo.json
REQUEST
RESPONSE
GET 200 https://api.2ip.ua/geo.json
REQUEST
RESPONSE
GET 200 http://cajgtus.com/lancer/get.php?pid=06280D9CD13939E9B7E95CDCAA6A83CC&first=true
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2027026 ET POLICY External IP Address Lookup DNS Query (2ip .ua) Device Retrieving External IP Address Detected
TCP 192.168.56.103:49171 -> 172.67.139.220:443 2033214 ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI) Potentially Bad Traffic
TCP 192.168.56.103:49171 -> 172.67.139.220:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49164 -> 172.67.139.220:443 2033214 ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI) Potentially Bad Traffic
TCP 192.168.56.103:49164 -> 172.67.139.220:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49172 -> 131.255.215.165:80 2002400 ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer) A Network Trojan was detected
TCP 192.168.56.103:49172 -> 131.255.215.165:80 2036334 ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key A Network Trojan was detected
TCP 131.255.215.165:80 -> 192.168.56.103:49172 2036335 ET MALWARE Win32/Filecoder.STOP Variant Public Key Download A Network Trojan was detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49171
172.67.139.220:443
C=US, O=Google Trust Services, CN=WE1 CN=2ip.ua ff:79:da:c4:72:a8:32:8f:28:1d:c9:7f:3a:b0:c3:0e:3f:7e:7e:a1
TLSv1
192.168.56.103:49164
172.67.139.220:443
C=US, O=Google Trust Services, CN=WE1 CN=2ip.ua ff:79:da:c4:72:a8:32:8f:28:1d:c9:7f:3a:b0:c3:0e:3f:7e:7e:a1

Snort Alerts

No Snort Alerts