NetWork | ZeroBOX

Network Analysis

IP Address Status Action
164.124.101.2 Active Moloch
191.55.76.236 Active Moloch
Name Response Post-Analysis Lookup
servidorwindows.ddns.com.br 191.55.76.236
GET 200 http://servidorwindows.ddns.com.br/Files/vbs.jpeg
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 191.55.76.236:80 -> 192.168.56.102:49165 2047750 ET MALWARE Base64 Encoded MZ In Image A Network Trojan was detected
TCP 191.55.76.236:80 -> 192.168.56.102:49165 2049038 ET MALWARE Malicious Base64 Encoded Payload In Image A Network Trojan was detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts