popup
NetWork | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Network Analysis

Download pcap
Hosts 2 DNS 0 TCP 3 UDP 3 HTTP 2 ICMP 0 IRC 1 Suricata Snort
IP Address Status Action
107.172.43.186 Active Moloch
107.173.154.7 Active Moloch
Name Response Post-Analysis Lookup
No hosts contacted.

No traffic

ICMP traffic

No ICMP traffic performed.

IRC traffic

Command Params Type
MODE RandomX mode: auto, fast, light client

Suricata Alerts

Flow SID Signature Category
TCP 107.173.154.7:9999 -> 192.168.56.103:49166 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 107.173.154.7:9999 -> 192.168.56.103:49166 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 107.173.154.7:9999 -> 192.168.56.103:49166 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 107.173.154.7:9999 -> 192.168.56.103:49167 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 107.173.154.7:9999 -> 192.168.56.103:49167 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 107.173.154.7:9999 -> 192.168.56.103:49167 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 107.173.154.7:9999 -> 192.168.56.103:49166 2000418 ET POLICY Executable and linking format (ELF) file download Potential Corporate Privacy Violation
TCP 107.173.154.7:9999 -> 192.168.56.103:49166 2000418 ET POLICY Executable and linking format (ELF) file download Potential Corporate Privacy Violation
TCP 107.173.154.7:9999 -> 192.168.56.103:49166 2000418 ET POLICY Executable and linking format (ELF) file download Potential Corporate Privacy Violation
TCP 107.173.154.7:9999 -> 192.168.56.103:49166 2000418 ET POLICY Executable and linking format (ELF) file download Potential Corporate Privacy Violation
TCP 107.173.154.7:9999 -> 192.168.56.103:49166 2000418 ET POLICY Executable and linking format (ELF) file download Potential Corporate Privacy Violation

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.3
192.168.56.103:49171
107.172.43.186:3939 		None None None

Snort Alerts

No Snort Alerts