NetWork | ZeroBOX

Network Analysis

IP Address Status Action
142.250.34.2 Active Moloch
164.124.101.2 Active Moloch
172.217.25.14 Active Moloch
210.65.244.176 Active Moloch
Name Response Post-Analysis Lookup
edgedl.gvt1.com 142.250.34.2
POST 403 https://210.65.244.176/
REQUEST
RESPONSE
POST 200 https://update.googleapis.com/service/update2?cup2key=10:1063268346&cup2hreq=aeb1fd103607563a549a6ba2077d24749f8c33da6854c0de7ef1993f7b40cbea
REQUEST
RESPONSE
POST 200 https://update.googleapis.com/service/update2
REQUEST
RESPONSE
POST 200 https://update.googleapis.com/service/update2
REQUEST
RESPONSE
HEAD 200 http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
REQUEST
RESPONSE
GET 206 http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
REQUEST
RESPONSE
GET 206 http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
REQUEST
RESPONSE
GET 206 http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
REQUEST
RESPONSE
GET 206 http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
REQUEST
RESPONSE
GET 206 http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
REQUEST
RESPONSE
GET 206 http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
REQUEST
RESPONSE
GET 206 http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
REQUEST
RESPONSE
GET 206 http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
REQUEST
RESPONSE
GET 206 http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
REQUEST
RESPONSE
GET 206 http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49819 -> 210.65.244.176:443 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.102:49820 -> 172.217.24.67:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49827 -> 172.217.24.67:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49826 -> 172.217.24.67:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 142.250.34.2:80 -> 192.168.56.102:49821 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 142.250.34.2:80 -> 192.168.56.102:49821 2014520 ET INFO EXE - Served Attached HTTP Misc activity
TCP 142.250.34.2:80 -> 192.168.56.102:49821 2015744 ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging) Misc activity

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49819
210.65.244.176:443
C=BL, ST=Atyho Aininsu1 olupl, L=Saint, O=doublebarrowfulSE, CN=Pithe-dwial.mz C=BL, ST=Atyho Aininsu1 olupl, L=Saint, O=doublebarrowfulSE, CN=Pithe-dwial.mz bf:3a:1f:85:42:55:48:1f:6a:81:9e:80:e1:9c:5e:9d:69:78:7b:42
TLS 1.2
192.168.56.102:49820
172.217.24.67:443
C=US, O=Google Trust Services, CN=GTS CA 1O1 C=US, ST=California, L=Mountain View, O=Google LLC, CN=upload.video.google.com 4f:cf:dd:03:b1:91:8c:80:31:c6:81:55:56:99:09:8d:2e:99:33:f0
TLS 1.2
192.168.56.102:49827
172.217.24.67:443
C=US, O=Google Trust Services, CN=GTS CA 1O1 C=US, ST=California, L=Mountain View, O=Google LLC, CN=upload.video.google.com 4f:cf:dd:03:b1:91:8c:80:31:c6:81:55:56:99:09:8d:2e:99:33:f0
TLS 1.2
192.168.56.102:49826
172.217.24.67:443
C=US, O=Google Trust Services, CN=GTS CA 1O1 C=US, ST=California, L=Mountain View, O=Google LLC, CN=upload.video.google.com 4f:cf:dd:03:b1:91:8c:80:31:c6:81:55:56:99:09:8d:2e:99:33:f0

Snort Alerts

No Snort Alerts