NetWork | ZeroBOX

Network Analysis

IP Address Status Action
164.124.101.2 Active Moloch
23.186.113.60 Active Moloch
74.208.132.59 Active Moloch
Name Response Post-Analysis Lookup
paste.ee 23.186.113.60
GET 200 http://74.208.132.59/112/weneedbestthingswithgreatnewsevengivenbestforentiretime.hta
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49164 -> 23.186.113.60:443 2034978 ET POLICY Pastebin-style Service (paste .ee) in TLS SNI Potential Corporate Privacy Violation
TCP 192.168.56.101:49164 -> 23.186.113.60:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49165 -> 23.186.113.60:443 2034978 ET POLICY Pastebin-style Service (paste .ee) in TLS SNI Potential Corporate Privacy Violation
TCP 192.168.56.101:49165 -> 23.186.113.60:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49164 -> 23.186.113.60:443 2034978 ET POLICY Pastebin-style Service (paste .ee) in TLS SNI Potential Corporate Privacy Violation
TCP 192.168.56.101:49165 -> 23.186.113.60:443 2034978 ET POLICY Pastebin-style Service (paste .ee) in TLS SNI Potential Corporate Privacy Violation
UDP 192.168.56.101:59002 -> 164.124.101.2:53 2054041 ET INFO Pastebin-like Service Domain in DNS Lookup (paste .ee) Misc activity
TCP 23.186.113.60:443 -> 192.168.56.101:49167 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49165 -> 23.186.113.60:443 2034978 ET POLICY Pastebin-style Service (paste .ee) in TLS SNI Potential Corporate Privacy Violation
TCP 192.168.56.101:49162 -> 74.208.132.59:80 2022520 ET POLICY Possible HTA Application Download Potentially Bad Traffic
TCP 192.168.56.101:49162 -> 74.208.132.59:80 2027261 ET INFO Dotted Quad Host HTA Request Potentially Bad Traffic
TCP 192.168.56.101:49162 -> 74.208.132.59:80 2024449 ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl Attempted User Privilege Gain
TCP 192.168.56.101:49165 -> 23.186.113.60:443 2034978 ET POLICY Pastebin-style Service (paste .ee) in TLS SNI Potential Corporate Privacy Violation
TCP 192.168.56.101:49164 -> 23.186.113.60:443 2034978 ET POLICY Pastebin-style Service (paste .ee) in TLS SNI Potential Corporate Privacy Violation
TCP 74.208.132.59:80 -> 192.168.56.101:49162 2024197 ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) A Network Trojan was detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts