NetWork | ZeroBOX

Network Analysis

IP Address Status Action
13.107.21.200 Active Moloch
164.124.101.2 Active Moloch
172.217.25.14 Active Moloch
195.128.123.215 Active Moloch
216.58.221.228 Active Moloch
216.58.199.100 Active Moloch
GET 200 https://www.google.com/
REQUEST
RESPONSE
GET 200 https://www.bing.com/
REQUEST
RESPONSE
GET 200 http://orpod.ru/def.exe
REQUEST
RESPONSE
GET 200 http://orpod.ru/putty.exe
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49805 -> 216.58.221.228:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49807 -> 13.107.21.200:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49812 -> 195.128.123.215:80 2019714 ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile Potentially Bad Traffic
TCP 195.128.123.215:80 -> 192.168.56.102:49812 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 195.128.123.215:80 -> 192.168.56.102:49812 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 192.168.56.102:49812 -> 195.128.123.215:80 2026570 ET HUNTING Possibly Suspicious Request for Putty.exe from Non-Standard Download Location Potentially Bad Traffic
TCP 195.128.123.215:80 -> 192.168.56.102:49812 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49805
216.58.221.228:443
C=US, O=Google Trust Services, CN=GTS CA 1O1 C=US, ST=California, L=Mountain View, O=Google LLC, CN=www.google.com 06:cb:c1:ed:3f:d8:18:b6:14:ee:10:02:2a:d8:2b:f3:bf:63:0f:20
TLSv1
192.168.56.102:49807
13.107.21.200:443
C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 02 CN=www.bing.com dc:c1:ac:40:22:1b:57:e3:9b:c9:2e:d2:eb:9b:a4:53:07:7f:62:f4

Snort Alerts

No Snort Alerts