NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.21.83.80 Active Moloch
164.124.101.2 Active Moloch
Name Response Post-Analysis Lookup
app-updater1.app 172.67.217.156
GET 200 https://app-updater1.app/api/getFile?fn=platon.hta
REQUEST
RESPONSE
GET 200 https://app-updater1.app/api/getFile?fn=platon.hta
REQUEST
RESPONSE
GET 200 https://app-updater1.app/api/getFile?fn=platon.exe
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49178 -> 104.21.83.80:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49171 -> 104.21.83.80:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49174 -> 104.21.83.80:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49178
104.21.83.80:443
C=US, O=Google Trust Services, CN=WE1 CN=app-updater1.app 26:9f:0d:9b:d2:44:1e:72:9c:a8:cf:f9:d3:cd:04:62:10:67:ac:cd
TLSv1
192.168.56.101:49171
104.21.83.80:443
C=US, O=Google Trust Services, CN=WE1 CN=app-updater1.app 26:9f:0d:9b:d2:44:1e:72:9c:a8:cf:f9:d3:cd:04:62:10:67:ac:cd
TLSv1
192.168.56.101:49174
104.21.83.80:443
C=US, O=Google Trust Services, CN=WE1 CN=app-updater1.app 26:9f:0d:9b:d2:44:1e:72:9c:a8:cf:f9:d3:cd:04:62:10:67:ac:cd

Snort Alerts

No Snort Alerts