NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.16.114.74 Active Moloch
109.71.208.62 Active Moloch
164.124.101.2 Active Moloch
199.91.155.9 Active Moloch
94.154.172.166 Active Moloch
GET 302 https://www.mediafire.com/file_premium/p3wr1k36iwfjl7y/Backup_Guide.pdf/file
REQUEST
RESPONSE
GET 200 http://94.154.172.166/rwrv/23.exe
REQUEST
RESPONSE
GET 200 http://poslisoubor.cz/gf.php?33f6c54a9a525e2c37453931c2aadebe/9.txt
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2043259 ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup Potentially Bad Traffic
TCP 192.168.56.103:49166 -> 199.91.155.9:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49165 -> 199.91.155.9:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49164 -> 104.16.114.74:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49167 -> 94.154.172.166:80 2022482 ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01 A Network Trojan was detected
TCP 192.168.56.103:49167 -> 94.154.172.166:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
UDP 192.168.56.103:50800 -> 164.124.101.2:53 2036936 ET HUNTING File Sharing Related Domain in DNS Lookup (download .mediafire .com) Potentially Bad Traffic
TCP 94.154.172.166:80 -> 192.168.56.103:49167 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 94.154.172.166:80 -> 192.168.56.103:49167 2021954 ET MALWARE JS/Nemucod.M.gen downloading EXE payload A Network Trojan was detected
TCP 94.154.172.166:80 -> 192.168.56.103:49167 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 94.154.172.166:80 -> 192.168.56.103:49167 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49164
104.16.114.74:443
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Organization Validation Secure Server CA C=US, ST=Texas, O=MEDIAFIRE, LLC, CN=*.mediafire.com 8b:fa:81:04:17:18:84:c4:3e:8e:d5:89:ad:d6:5d:bd:9a:df:84:da

Snort Alerts

No Snort Alerts