NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.74.170.104 Active Moloch
116.203.6.46 Active Moloch
147.45.44.104 Active Moloch
149.154.167.99 Active Moloch
164.124.101.2 Active Moloch
46.8.231.109 Active Moloch
GET 200 https://steamcommunity.com/profiles/76561199768374681
REQUEST
RESPONSE
GET 200 http://46.8.231.109/
REQUEST
RESPONSE
POST 200 http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
POST 200 http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
POST 200 http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
POST 200 http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
POST 200 http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
GET 200 http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll
REQUEST
RESPONSE
POST 200 http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
GET 200 http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll
REQUEST
RESPONSE
GET 200 http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll
REQUEST
RESPONSE
GET 200 http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll
REQUEST
RESPONSE
GET 200 http://46.8.231.109/1309cdeb8f4c8736/nss3.dll
REQUEST
RESPONSE
GET 200 http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll
REQUEST
RESPONSE
GET 200 http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll
REQUEST
RESPONSE
POST 200 http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
POST 200 http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
POST 200 http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
POST 200 http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
POST 200 http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
POST 200 http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
POST 200 http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
POST 200 http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
GET 200 http://147.45.44.104/prog/66d5ddcbb9f86_vyre.exe
REQUEST
RESPONSE
GET 200 http://147.45.44.104/prog/66d5ddc254656_lfem.exe
REQUEST
RESPONSE
POST 0 http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49164 -> 46.8.231.109:80 2044243 ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in Malware Command and Control Activity Detected
TCP 192.168.56.103:49164 -> 46.8.231.109:80 2044244 ET MALWARE Win32/Stealc Requesting browsers Config from C2 Malware Command and Control Activity Detected
TCP 46.8.231.109:80 -> 192.168.56.103:49164 2051828 ET MALWARE Win32/Stealc Active C2 Responding with browsers Config M1 Malware Command and Control Activity Detected
TCP 192.168.56.103:49164 -> 46.8.231.109:80 2044246 ET MALWARE Win32/Stealc Requesting plugins Config from C2 Malware Command and Control Activity Detected
TCP 46.8.231.109:80 -> 192.168.56.103:49164 2051831 ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 Malware Command and Control Activity Detected
TCP 192.168.56.103:49164 -> 46.8.231.109:80 2044248 ET MALWARE Win32/Stealc Submitting System Information to C2 Malware Command and Control Activity Detected
TCP 192.168.56.103:49164 -> 46.8.231.109:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49164 -> 46.8.231.109:80 2044301 ET HUNTING HTTP GET Request for sqlite3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 46.8.231.109:80 -> 192.168.56.103:49164 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 46.8.231.109:80 -> 192.168.56.103:49164 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 147.45.44.104:80 -> 192.168.56.103:49167 2400022 ET DROP Spamhaus DROP Listed Traffic Inbound group 23 Misc Attack
TCP 192.168.56.103:49167 -> 147.45.44.104:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 46.8.231.109:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 46.8.231.109:80 2044303 ET HUNTING HTTP GET Request for freebl3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 147.45.44.104:80 -> 192.168.56.103:49167 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 147.45.44.104:80 -> 192.168.56.103:49167 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 147.45.44.104:80 -> 192.168.56.103:49167 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 46.8.231.109:80 -> 192.168.56.103:49165 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 46.8.231.109:80 -> 192.168.56.103:49165 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 149.154.167.99:443 -> 192.168.56.103:49184 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49182 -> 149.154.167.99:443 2041933 ET INFO Observed Telegram Domain (t .me in TLS SNI) Misc activity
TCP 192.168.56.103:49182 -> 149.154.167.99:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49182 -> 149.154.167.99:443 2041933 ET INFO Observed Telegram Domain (t .me in TLS SNI) Misc activity
TCP 192.168.56.103:49167 -> 147.45.44.104:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 147.45.44.104:80 -> 192.168.56.103:49167 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 147.45.44.104:80 -> 192.168.56.103:49167 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49183 -> 149.154.167.99:443 2041933 ET INFO Observed Telegram Domain (t .me in TLS SNI) Misc activity
TCP 192.168.56.103:49183 -> 149.154.167.99:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49183 -> 149.154.167.99:443 2041933 ET INFO Observed Telegram Domain (t .me in TLS SNI) Misc activity
TCP 192.168.56.103:49186 -> 104.74.170.104:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49165 -> 46.8.231.109:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 46.8.231.109:80 2044302 ET HUNTING HTTP GET Request for mozglue.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 46.8.231.109:80 -> 192.168.56.103:49165 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 46.8.231.109:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 46.8.231.109:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 46.8.231.109:80 2044305 ET HUNTING HTTP GET Request for nss3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 192.168.56.103:49165 -> 46.8.231.109:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 46.8.231.109:80 2044306 ET HUNTING HTTP GET Request for softokn3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 192.168.56.103:49165 -> 46.8.231.109:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 46.8.231.109:80 2044307 ET HUNTING HTTP GET Request for vcruntime140.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 116.203.6.46:443 -> 192.168.56.103:49189 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49182 -> 149.154.167.99:443 2041933 ET INFO Observed Telegram Domain (t .me in TLS SNI) Misc activity

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49186
104.74.170.104:443
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Extended Validation Server CA unknown=US, unknown=Washington, unknown=Private Organization, serialNumber=602 290 773, C=US, ST=Washington, L=Bellevue, O=Valve Corp, CN=store.steampowered.com 10:20:2b:ee:30:69:cc:b6:ac:5e:47:04:71:ca:b0:75:78:51:58:f5

Snort Alerts

No Snort Alerts