NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.74.217.16 Active Moloch
142.250.34.2 Active Moloch
164.124.101.2 Active Moloch
172.217.25.14 Active Moloch
65.55.186.115 Active Moloch
POST 200 https://update.googleapis.com/service/update2?cup2key=10:3707086078&cup2hreq=592b5a7ff2243112c27bdf312679deb8995ad1805b60657c9d1c3fddf67a8fb2
REQUEST
RESPONSE
POST 200 https://update.googleapis.com/service/update2
REQUEST
RESPONSE
POST 200 https://update.googleapis.com/service/update2
REQUEST
RESPONSE
GET 302 http://go.microsoft.com/fwlink?linkid=30219&locale=ko-KR&clientType=VISTA_GAMES&clientVersion=6.1.2
REQUEST
RESPONSE
HEAD 200 http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
REQUEST
RESPONSE
GET 206 http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
REQUEST
RESPONSE
GET 206 http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
REQUEST
RESPONSE
GET 206 http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
REQUEST
RESPONSE
GET 206 http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
REQUEST
RESPONSE
GET 206 http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
REQUEST
RESPONSE
GET 206 http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
REQUEST
RESPONSE
GET 206 http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
REQUEST
RESPONSE
GET 206 http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
REQUEST
RESPONSE
GET 206 http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
REQUEST
RESPONSE
GET 206 http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49812 -> 172.217.161.131:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49814 -> 172.217.161.131:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49815 -> 172.217.161.131:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 142.250.34.2:80 -> 192.168.56.102:49813 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 142.250.34.2:80 -> 192.168.56.102:49813 2014520 ET INFO EXE - Served Attached HTTP Misc activity
TCP 142.250.34.2:80 -> 192.168.56.102:49813 2015744 ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging) Misc activity

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.2
192.168.56.102:49812
172.217.161.131:443
C=US, O=Google Trust Services, CN=GTS CA 1O1 C=US, ST=California, L=Mountain View, O=Google LLC, CN=upload.video.google.com 3a:64:d0:6c:61:07:6b:6b:27:d2:ca:a4:29:2c:fe:46:60:2e:51:1c
TLS 1.2
192.168.56.102:49814
172.217.161.131:443
C=US, O=Google Trust Services, CN=GTS CA 1O1 C=US, ST=California, L=Mountain View, O=Google LLC, CN=upload.video.google.com 3a:64:d0:6c:61:07:6b:6b:27:d2:ca:a4:29:2c:fe:46:60:2e:51:1c
TLS 1.2
192.168.56.102:49815
172.217.161.131:443
C=US, O=Google Trust Services, CN=GTS CA 1O1 C=US, ST=California, L=Mountain View, O=Google LLC, CN=upload.video.google.com 3a:64:d0:6c:61:07:6b:6b:27:d2:ca:a4:29:2c:fe:46:60:2e:51:1c

Snort Alerts

No Snort Alerts