NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.16.113.74 Active Moloch
104.21.82.89 Active Moloch
164.124.101.2 Active Moloch
199.91.155.16 Active Moloch
199.91.155.21 Active Moloch
GET 200 https://www.mediafire.com/file/uq6estxvdnk3zze/ofeduqin1.rar/file
REQUEST
RESPONSE
GET 200 https://www.mediafire.com/file/hzktcfc598wc4c7/bipucowova2.rar/file
REQUEST
RESPONSE
GET 200 https://maper.info/1wHV45
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49186 -> 104.21.82.89:443 2026897 ET POLICY IP Logger Redirect Domain in SNI Potential Corporate Privacy Violation
TCP 192.168.56.101:49186 -> 104.21.82.89:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.101:59002 -> 164.124.101.2:53 2043259 ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup Potentially Bad Traffic
TCP 192.168.56.101:49170 -> 104.16.113.74:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49181 -> 199.91.155.16:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49168 -> 104.16.113.74:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.101:54148 -> 164.124.101.2:53 2036936 ET HUNTING File Sharing Related Domain in DNS Lookup (download .mediafire .com) Potentially Bad Traffic
TCP 192.168.56.101:49180 -> 199.91.155.16:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49183 -> 199.91.155.21:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49184 -> 199.91.155.21:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.101:53004 -> 164.124.101.2:53 2036936 ET HUNTING File Sharing Related Domain in DNS Lookup (download .mediafire .com) Potentially Bad Traffic

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49186
104.21.82.89:443
C=US, O=Google Trust Services, CN=WE1 CN=maper.info 82:d2:e6:7c:a7:a4:09:26:ec:81:63:ba:47:0e:41:05:89:c0:9d:5b
TLSv1
192.168.56.101:49170
104.16.113.74:443
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Organization Validation Secure Server CA C=US, ST=Texas, O=MEDIAFIRE, LLC, CN=*.mediafire.com 8b:fa:81:04:17:18:84:c4:3e:8e:d5:89:ad:d6:5d:bd:9a:df:84:da
TLSv1
192.168.56.101:49168
104.16.113.74:443
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Organization Validation Secure Server CA C=US, ST=Texas, O=MEDIAFIRE, LLC, CN=*.mediafire.com 8b:fa:81:04:17:18:84:c4:3e:8e:d5:89:ad:d6:5d:bd:9a:df:84:da

Snort Alerts

No Snort Alerts