popup
NetWork | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Network Analysis

Download pcap
Hosts 3 DNS 4 TCP 2 UDP 13 HTTP(S) 1 ICMP 0 IRC 0 Suricata Snort
IP Address Status Action
131.255.106.152 Active Moloch
164.124.101.2 Active Moloch
23.21.27.29 Active Moloch
GET 200 http://checkip.amazonaws.com/
REQUEST
RESPONSE
BODY 

            

        


    



        
	




                            
ICMP traffic



No ICMP traffic performed.



                            
IRC traffic



No IRC requests performed.



                            
Suricata Alerts


    

        

            Flow
            SID
            Signature
            Category
        

        
        

            
                TCP
                192.168.56.101:49207 ->
                23.21.27.29:80
            
            2013028
            ET POLICY curl User-Agent Outbound
            Attempted Information Leak
        

        
        

            
                TCP
                192.168.56.101:49206 ->
                131.255.106.152:449
            
            2404303
            ET CNC Feodo Tracker Reported CnC Server group 4
            A Network Trojan was detected
        

        
        

            
                TCP
                192.168.56.101:49206 ->
                131.255.106.152:449
            
            2028401
            ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex
            Unknown Traffic
        

        
        

            
                TCP
                131.255.106.152:449 ->
                192.168.56.101:49206
            
            2011540
            ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)
            Not Suspicious Traffic
        

        
    




Suricata TLS


    

        

            Flow
            Issuer
            Subject
            Fingerprint
        

        
        

            
                TLSv1 

                192.168.56.101:49206 

                131.255.106.152:449
            		
            C=AU, ST=Some-State, O=Internet Widgits Pty Ltd
            C=AU, ST=Some-State, O=Internet Widgits Pty Ltd
            f8:68:0a:74:96:dc:19:0a:62:fa:35:3d:ca:ef:06:ff:20:bd:f4:c8
        

        
    





                            
Snort Alerts


    
No Snort Alerts