Network Analysis
| IP Address | Status | Action | VT | Location |
|---|---|---|---|---|
| No hosts contacted. | ||||
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
No traffic
No traffic
No traffic
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| UDP 192.168.168.208:61100 -> 8.8.8.8:53 | 2027863 | ET INFO Observed DNS Query to .biz TLD | Potentially Bad Traffic |
| UDP 192.168.168.208:63658 -> 8.8.8.8:53 | 2027863 | ET INFO Observed DNS Query to .biz TLD | Potentially Bad Traffic |
| TCP 192.168.168.208:49237 -> 52.11.240.239:80 | 2850851 | ETPRO MALWARE Win32/Expiro.NDO CnC Activity | Malware Command and Control Activity Detected |
| UDP 192.168.168.208:64652 -> 8.8.8.8:53 | 2027863 | ET INFO Observed DNS Query to .biz TLD | Potentially Bad Traffic |
| TCP 52.11.240.239:80 -> 192.168.168.208:49237 | 2018141 | ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz | A Network Trojan was detected |
| TCP 52.11.240.239:80 -> 192.168.168.208:49237 | 2037771 | ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst | A Network Trojan was detected |
| UDP 192.168.168.208:65450 -> 8.8.8.8:53 | 2027863 | ET INFO Observed DNS Query to .biz TLD | Potentially Bad Traffic |
Suricata TLS
No Suricata TLS
Snort Alerts
| Flow | SID | Message |
|---|---|---|
| UDP 192.168.168.208:61100 -> 8.8.8.8:53 | 2027863 | ET INFO Observed DNS Query to .biz TLD |
| UDP 192.168.168.208:63658 -> 8.8.8.8:53 | 2027863 | ET INFO Observed DNS Query to .biz TLD |
| UDP 192.168.168.208:64652 -> 8.8.8.8:53 | 2027863 | ET INFO Observed DNS Query to .biz TLD |
| UDP 192.168.168.208:65450 -> 8.8.8.8:53 | 2027863 | ET INFO Observed DNS Query to .biz TLD |
