NetWork | ZeroBOX

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.67.128.126	Active	Moloch
185.196.10.57	Active	Moloch
185.216.214.218	Active	Moloch

Name	Response	Post-Analysis Lookup
solutionhub.cc	A 172.67.128.126 A 104.21.2.10	172.67.128.126

TCP Requests

UDP Requests

GET 200 https://solutionhub.cc/socket/?id=08CA843D0A15D2560E8FA7EE94E71AC9B38318DF02721EA26194DF153A2BEEA0&us=1ACC94780D1E&mn=3AECB4580D1EC6312C&os=39C08968505B9841589FC5AB9AE31E8EF2DC42D055785DDC&bld=1CC68878051DC553418AD7

GET 200 http://185.196.10.57/selectex-file-host/Tgnviazinc.exe

GET 200 http://185.216.214.218/Population.exe

GET 200 http://185.196.10.57/selectex-file-host/linkedin.exe

GET 200 http://185.196.10.57/selectex-file-host/acev.exe

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.103:52760 -> 164.124.101.2:53	2054416	ET MALWARE ZharkBot CnC Domain in DNS Lookup (solutionhub .cc)	A Network Trojan was detected
UDP 192.168.56.103:52760 -> 164.124.101.2:53	2027758	ET DNS Query for .cc TLD	Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 172.67.128.126:443	2054418	ET MALWARE Observed ZharkBot Domain (solutionhub .cc in TLS SNI)	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 172.67.128.126:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49166 -> 185.196.10.57:80	2054413	ET MALWARE ZharkBot User-Agent Observed	A Network Trojan was detected
TCP 192.168.56.103:49166 -> 185.196.10.57:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 192.168.56.103:49167 -> 172.67.128.126:443	2054418	ET MALWARE Observed ZharkBot Domain (solutionhub .cc in TLS SNI)	A Network Trojan was detected
TCP 192.168.56.103:49167 -> 172.67.128.126:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 185.196.10.57:80 -> 192.168.56.103:49166	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 185.196.10.57:80 -> 192.168.56.103:49166	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.103:49169 -> 185.216.214.218:80	2054413	ET MALWARE ZharkBot User-Agent Observed	A Network Trojan was detected
TCP 192.168.56.103:49169 -> 185.216.214.218:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 185.216.214.218:80 -> 192.168.56.103:49169	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 185.216.214.218:80 -> 192.168.56.103:49169	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.103:49170 -> 185.196.10.57:80	2054413	ET MALWARE ZharkBot User-Agent Observed	A Network Trojan was detected
TCP 192.168.56.103:49170 -> 185.196.10.57:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 185.196.10.57:80 -> 192.168.56.103:49170	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 185.196.10.57:80 -> 192.168.56.103:49170	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.103:49170 -> 185.196.10.57:80	2054413	ET MALWARE ZharkBot User-Agent Observed	A Network Trojan was detected
TCP 192.168.56.103:49170 -> 185.196.10.57:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 185.196.10.57:80 -> 192.168.56.103:49170	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49165 172.67.128.126:443	C=US, O=Google Trust Services, CN=WE1	CN=solutionhub.cc	95:e3:33:ac:ac:3e:7c:88:2a:80:ec:a7:59:c6:13:67:fc:5c:69:3d
TLSv1 192.168.56.103:49167 172.67.128.126:443	C=US, O=Google Trust Services, CN=WE1	CN=solutionhub.cc	95:e3:33:ac:ac:3e:7c:88:2a:80:ec:a7:59:c6:13:67:fc:5c:69:3d

Snort Alerts

No Snort Alerts