NetWork | ZeroBOX

Network Analysis

IP Address Status Action
103.28.36.182 Active Moloch
104.20.3.235 Active Moloch
164.124.101.2 Active Moloch
172.67.169.89 Active Moloch
185.199.111.133 Active Moloch
GET 200 https://pastebin.com/raw/E0rY26ni
REQUEST
RESPONSE
GET 200 https://yip.su/RNWPd.exe
REQUEST
RESPONSE
GET 200 http://namphuctourist.com/tmp/1.exe
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:59002 -> 164.124.101.2:53 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related Potentially Bad Traffic
TCP 192.168.56.101:49165 -> 104.20.3.235:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49167 -> 185.199.111.133:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49166 -> 172.67.169.89:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49168 -> 103.28.36.182:80 2018581 ET MALWARE Single char EXE direct download likely trojan (multiple families) A Network Trojan was detected
TCP 192.168.56.101:49168 -> 103.28.36.182:80 2016985 ET INFO Executable Served From /tmp/ Directory - Malware Hosting Behaviour Potentially Bad Traffic
TCP 103.28.36.182:80 -> 192.168.56.101:49168 2014819 ET INFO Packed Executable Download Misc activity
TCP 103.28.36.182:80 -> 192.168.56.101:49168 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 103.28.36.182:80 -> 192.168.56.101:49168 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.2
192.168.56.101:49165
104.20.3.235:443
C=US, O=Google Trust Services, CN=WE1 CN=pastebin.com 82:49:c5:04:9a:bd:a9:c1:ab:4d:ff:95:b9:94:74:cc:40:bc:09:7f
TLS 1.2
192.168.56.101:49167
185.199.111.133:443
C=US, O=DigiCert Inc, CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1 C=US, ST=California, L=San Francisco, O=GitHub, Inc., CN=*.github.io 97:d8:c5:70:0f:12:24:6c:88:bc:fa:06:7e:8c:a7:4d:a8:62:67:28
TLS 1.2
192.168.56.101:49166
172.67.169.89:443
C=US, O=Google Trust Services, CN=WE1 CN=yip.su cd:f2:dd:c5:ee:57:d1:5f:01:8c:10:00:ac:b5:85:96:0e:f7:0a:32

Snort Alerts

No Snort Alerts