popup
NetWork | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Network Analysis

Download pcap
Hosts 3 DNS 1 TCP 2 UDP 7 HTTP 3 ICMP 0 IRC 1 Suricata Snort
IP Address Status Action
130.185.118.247 Active Moloch
157.20.104.252 Active Moloch
164.124.101.2 Active Moloch
Name Response Post-Analysis Lookup
pool.hashvault.pro
A 157.20.104.252
A 51.79.163.234
157.20.104.252

No traffic

ICMP traffic

No ICMP traffic performed.

IRC traffic

Command Params Type
MODE RandomX mode: auto, fast, light client

Suricata Alerts

Flow SID Signature Category
TCP 130.185.118.247:9090 -> 192.168.56.102:49164 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 130.185.118.247:9090 -> 192.168.56.102:49164 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 130.185.118.247:9090 -> 192.168.56.102:49164 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
UDP 192.168.56.102:63709 -> 164.124.101.2:53 2036289 ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro) Crypto Currency Mining Activity Detected
TCP 130.185.118.247:9090 -> 192.168.56.102:49164 2000418 ET POLICY Executable and linking format (ELF) file download Potential Corporate Privacy Violation
TCP 130.185.118.247:9090 -> 192.168.56.102:49164 2000418 ET POLICY Executable and linking format (ELF) file download Potential Corporate Privacy Violation
TCP 130.185.118.247:9090 -> 192.168.56.102:49164 2000418 ET POLICY Executable and linking format (ELF) file download Potential Corporate Privacy Violation
TCP 130.185.118.247:9090 -> 192.168.56.102:49164 2000418 ET POLICY Executable and linking format (ELF) file download Potential Corporate Privacy Violation
TCP 192.168.56.102:49164 -> 130.185.118.247:9090 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.3
192.168.56.102:49170
157.20.104.252:443 		None None None

Snort Alerts

No Snort Alerts