NetWork | ZeroBOX

Network Analysis

IP Address Status Action
162.241.61.218 Active Moloch
164.124.101.2 Active Moloch
46.8.231.109 Active Moloch
Name Response Post-Analysis Lookup
nerv.com.pe 162.241.61.218
GET 200 http://46.8.231.109/
REQUEST
RESPONSE
POST 200 http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
POST 200 http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
POST 200 http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
POST 200 http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
POST 200 http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
GET 200 http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll
REQUEST
RESPONSE
POST 200 http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
GET 200 http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll
REQUEST
RESPONSE
GET 200 http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll
REQUEST
RESPONSE
GET 200 http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll
REQUEST
RESPONSE
GET 200 http://46.8.231.109/1309cdeb8f4c8736/nss3.dll
REQUEST
RESPONSE
GET 200 http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll
REQUEST
RESPONSE
GET 200 http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll
REQUEST
RESPONSE
POST 200 http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
POST 200 http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
POST 200 http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
POST 200 http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
POST 200 http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
POST 200 http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
POST 200 http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
POST 200 http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
POST 200 http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49164 -> 46.8.231.109:80 2044243 ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in Malware Command and Control Activity Detected
TCP 192.168.56.103:49164 -> 46.8.231.109:80 2044244 ET MALWARE Win32/Stealc Requesting browsers Config from C2 Malware Command and Control Activity Detected
TCP 46.8.231.109:80 -> 192.168.56.103:49164 2051828 ET MALWARE Win32/Stealc Active C2 Responding with browsers Config M1 Malware Command and Control Activity Detected
TCP 192.168.56.103:49164 -> 46.8.231.109:80 2044246 ET MALWARE Win32/Stealc Requesting plugins Config from C2 Malware Command and Control Activity Detected
TCP 46.8.231.109:80 -> 192.168.56.103:49164 2051831 ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 Malware Command and Control Activity Detected
TCP 192.168.56.103:49164 -> 46.8.231.109:80 2044248 ET MALWARE Win32/Stealc Submitting System Information to C2 Malware Command and Control Activity Detected
TCP 192.168.56.103:49164 -> 46.8.231.109:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49164 -> 46.8.231.109:80 2044301 ET HUNTING HTTP GET Request for sqlite3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 46.8.231.109:80 -> 192.168.56.103:49164 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 46.8.231.109:80 -> 192.168.56.103:49164 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 46.8.231.109:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 46.8.231.109:80 2044303 ET HUNTING HTTP GET Request for freebl3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 46.8.231.109:80 -> 192.168.56.103:49165 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 46.8.231.109:80 -> 192.168.56.103:49165 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 192.168.56.103:49172 -> 162.241.61.218:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49168 -> 162.241.61.218:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49174 -> 162.241.61.218:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49165 -> 46.8.231.109:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 46.8.231.109:80 2044302 ET HUNTING HTTP GET Request for mozglue.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 46.8.231.109:80 -> 192.168.56.103:49165 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 192.168.56.103:49167 -> 162.241.61.218:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49165 -> 46.8.231.109:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 46.8.231.109:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 46.8.231.109:80 2044305 ET HUNTING HTTP GET Request for nss3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 192.168.56.103:49165 -> 46.8.231.109:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 46.8.231.109:80 2044306 ET HUNTING HTTP GET Request for softokn3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 192.168.56.103:49165 -> 46.8.231.109:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 46.8.231.109:80 2044307 ET HUNTING HTTP GET Request for vcruntime140.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 162.241.61.218:443 -> 192.168.56.103:49169 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 162.241.61.218:443 -> 192.168.56.103:49175 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts