Network Analysis

Download pcap
Hosts 0 DNS 0 TCP 0 UDP 0 HTTP 0 ICMP 0 IRC 0 Suricata Snort
IP Address Status Action VT Location
No hosts contacted.
Name Response Post-Analysis Lookup
No hosts contacted.

No traffic

No traffic

No traffic

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
UDP 192.168.168.221:61000 -> 8.8.8.8:53 2027863 ET INFO Observed DNS Query to .biz TLD Potentially Bad Traffic
UDP 192.168.168.221:59348 -> 8.8.8.8:53 2027863 ET INFO Observed DNS Query to .biz TLD Potentially Bad Traffic
TCP 192.168.168.221:49269 -> 52.11.240.239:80 2850851 ETPRO MALWARE Win32/Expiro.NDO CnC Activity Malware Command and Control Activity Detected
UDP 192.168.168.221:61741 -> 8.8.8.8:53 2027863 ET INFO Observed DNS Query to .biz TLD Potentially Bad Traffic
TCP 52.11.240.239:80 -> 192.168.168.221:49270 2018141 ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz A Network Trojan was detected
TCP 52.11.240.239:80 -> 192.168.168.221:49270 2037771 ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst A Network Trojan was detected
UDP 192.168.168.221:56024 -> 8.8.8.8:53 2027863 ET INFO Observed DNS Query to .biz TLD Potentially Bad Traffic
TCP 18.234.103.197:80 -> 192.168.168.221:49273 2018141 ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz A Network Trojan was detected
TCP 18.234.103.197:80 -> 192.168.168.221:49273 2037771 ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst A Network Trojan was detected
UDP 192.168.168.221:56024 -> 8.8.8.8:53 2027863 ET INFO Observed DNS Query to .biz TLD Potentially Bad Traffic
UDP 192.168.168.221:58930 -> 8.8.8.8:53 2027863 ET INFO Observed DNS Query to .biz TLD Potentially Bad Traffic
UDP 192.168.168.221:63169 -> 8.8.8.8:53 2051648 ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz) A Network Trojan was detected
UDP 192.168.168.221:63169 -> 8.8.8.8:53 2027863 ET INFO Observed DNS Query to .biz TLD Potentially Bad Traffic
TCP 3.229.117.57:80 -> 192.168.168.221:49275 2018141 ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz A Network Trojan was detected
TCP 3.229.117.57:80 -> 192.168.168.221:49275 2037771 ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst A Network Trojan was detected
UDP 192.168.168.221:56094 -> 8.8.8.8:53 2027863 ET INFO Observed DNS Query to .biz TLD Potentially Bad Traffic
UDP 192.168.168.221:54842 -> 8.8.8.8:53 2051649 ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz) A Network Trojan was detected
UDP 192.168.168.221:54842 -> 8.8.8.8:53 2027863 ET INFO Observed DNS Query to .biz TLD Potentially Bad Traffic
UDP 192.168.168.221:58570 -> 8.8.8.8:53 2027863 ET INFO Observed DNS Query to .biz TLD Potentially Bad Traffic
UDP 192.168.168.221:60789 -> 8.8.8.8:53 2027863 ET INFO Observed DNS Query to .biz TLD Potentially Bad Traffic
UDP 192.168.168.221:58849 -> 8.8.8.8:53 2027863 ET INFO Observed DNS Query to .biz TLD Potentially Bad Traffic
UDP 192.168.168.221:51355 -> 8.8.8.8:53 2027863 ET INFO Observed DNS Query to .biz TLD Potentially Bad Traffic
TCP 192.64.119.165:80 -> 192.168.168.221:49279 2035208 ET INFO Namecheap URL Forward Misc activity

Suricata TLS

No Suricata TLS

Snort Alerts

Flow SID Message
UDP 192.168.168.221:61000 -> 8.8.8.8:53 2027863 ET INFO Observed DNS Query to .biz TLD
UDP 192.168.168.221:59348 -> 8.8.8.8:53 2027863 ET INFO Observed DNS Query to .biz TLD
UDP 192.168.168.221:61741 -> 8.8.8.8:53 2027863 ET INFO Observed DNS Query to .biz TLD
UDP 192.168.168.221:56024 -> 8.8.8.8:53 2027863 ET INFO Observed DNS Query to .biz TLD
UDP 192.168.168.221:56024 -> 8.8.8.8:53 2027863 ET INFO Observed DNS Query to .biz TLD
UDP 192.168.168.221:58930 -> 8.8.8.8:53 2027863 ET INFO Observed DNS Query to .biz TLD
UDP 192.168.168.221:63169 -> 8.8.8.8:53 2027863 ET INFO Observed DNS Query to .biz TLD
UDP 192.168.168.221:56094 -> 8.8.8.8:53 2027863 ET INFO Observed DNS Query to .biz TLD
UDP 192.168.168.221:54842 -> 8.8.8.8:53 2027863 ET INFO Observed DNS Query to .biz TLD
UDP 192.168.168.221:58570 -> 8.8.8.8:53 2027863 ET INFO Observed DNS Query to .biz TLD
UDP 192.168.168.221:60789 -> 8.8.8.8:53 2027863 ET INFO Observed DNS Query to .biz TLD
UDP 192.168.168.221:58849 -> 8.8.8.8:53 2027863 ET INFO Observed DNS Query to .biz TLD
TCP 192.64.119.165:80 -> 192.168.168.221:49279 2035208 ET INFO Namecheap URL Forward
UDP 192.168.168.221:51355 -> 8.8.8.8:53 2027863 ET INFO Observed DNS Query to .biz TLD
Cuckoo

We're processing your submission... This could take a few seconds.