Network Analysis

Download pcap
Hosts 0 DNS 0 TCP 0 UDP 0 HTTP 0 ICMP 0 IRC 0 Suricata Snort
IP Address Status Action VT Location
No hosts contacted.
Name Response Post-Analysis Lookup
No hosts contacted.

No traffic

No traffic

No traffic

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.168.229:49234 -> 23.228.66.219:6667 2808257 ETPRO MALWARE Backdoor.Win32.Delf.ars IRC Checkin Malware Command and Control Activity Detected
TCP 192.168.168.229:49234 -> 23.228.66.219:6667 2002028 ET CHAT IRC PONG response Misc activity
TCP 192.168.168.229:49234 -> 23.228.66.219:6667 2002024 ET CHAT IRC NICK command Misc activity
TCP 192.168.168.229:49234 -> 23.228.66.219:6667 2808257 ETPRO MALWARE Backdoor.Win32.Delf.ars IRC Checkin Malware Command and Control Activity Detected
TCP 192.168.168.229:49237 -> 23.228.66.219:6667 2808257 ETPRO MALWARE Backdoor.Win32.Delf.ars IRC Checkin Malware Command and Control Activity Detected
TCP 192.168.168.229:49237 -> 23.228.66.219:6667 2002028 ET CHAT IRC PONG response Misc activity
TCP 192.168.168.229:49237 -> 23.228.66.219:6667 2002024 ET CHAT IRC NICK command Misc activity
TCP 192.168.168.229:49237 -> 23.228.66.219:6667 2808257 ETPRO MALWARE Backdoor.Win32.Delf.ars IRC Checkin Malware Command and Control Activity Detected
TCP 192.168.168.229:49238 -> 23.228.66.219:6667 2808257 ETPRO MALWARE Backdoor.Win32.Delf.ars IRC Checkin Malware Command and Control Activity Detected
TCP 192.168.168.229:49238 -> 23.228.66.219:6667 2002028 ET CHAT IRC PONG response Misc activity
TCP 192.168.168.229:49238 -> 23.228.66.219:6667 2002024 ET CHAT IRC NICK command Misc activity
TCP 192.168.168.229:49238 -> 23.228.66.219:6667 2808257 ETPRO MALWARE Backdoor.Win32.Delf.ars IRC Checkin Malware Command and Control Activity Detected
TCP 192.168.168.229:49239 -> 23.228.66.219:6667 2808257 ETPRO MALWARE Backdoor.Win32.Delf.ars IRC Checkin Malware Command and Control Activity Detected
TCP 23.228.66.219:6667 -> 192.168.168.229:49239 2812135 ETPRO INFO Possible IRC Botnet Activity - Throttled Connection Potential Corporate Privacy Violation
TCP 192.168.168.229:49239 -> 23.228.66.219:6667 2002024 ET CHAT IRC NICK command Misc activity
TCP 192.168.168.229:49239 -> 23.228.66.219:6667 2808257 ETPRO MALWARE Backdoor.Win32.Delf.ars IRC Checkin Malware Command and Control Activity Detected
TCP 192.168.168.229:49240 -> 23.228.66.219:6667 2808257 ETPRO MALWARE Backdoor.Win32.Delf.ars IRC Checkin Malware Command and Control Activity Detected
TCP 192.168.168.229:49240 -> 23.228.66.219:6667 2002024 ET CHAT IRC NICK command Misc activity
TCP 192.168.168.229:49240 -> 23.228.66.219:6667 2808257 ETPRO MALWARE Backdoor.Win32.Delf.ars IRC Checkin Malware Command and Control Activity Detected
TCP 192.168.168.229:49241 -> 23.228.66.219:6667 2808257 ETPRO MALWARE Backdoor.Win32.Delf.ars IRC Checkin Malware Command and Control Activity Detected
TCP 192.168.168.229:49241 -> 23.228.66.219:6667 2002024 ET CHAT IRC NICK command Misc activity
TCP 192.168.168.229:49241 -> 23.228.66.219:6667 2808257 ETPRO MALWARE Backdoor.Win32.Delf.ars IRC Checkin Malware Command and Control Activity Detected
TCP 192.168.168.229:49242 -> 23.228.66.219:6667 2808257 ETPRO MALWARE Backdoor.Win32.Delf.ars IRC Checkin Malware Command and Control Activity Detected
TCP 192.168.168.229:49242 -> 23.228.66.219:6667 2002024 ET CHAT IRC NICK command Misc activity
TCP 192.168.168.229:49242 -> 23.228.66.219:6667 2808257 ETPRO MALWARE Backdoor.Win32.Delf.ars IRC Checkin Malware Command and Control Activity Detected
TCP 192.168.168.229:49243 -> 23.228.66.219:6667 2808257 ETPRO MALWARE Backdoor.Win32.Delf.ars IRC Checkin Malware Command and Control Activity Detected
TCP 23.228.66.219:6667 -> 192.168.168.229:49237 2002027 ET CHAT IRC PING command Misc activity
TCP 23.228.66.219:6667 -> 192.168.168.229:49238 2002027 ET CHAT IRC PING command Misc activity
TCP 23.228.66.219:6667 -> 192.168.168.229:49234 2002027 ET CHAT IRC PING command Misc activity
TCP 192.168.168.229:49243 -> 23.228.66.219:6667 2002024 ET CHAT IRC NICK command Misc activity
TCP 192.168.168.229:49243 -> 23.228.66.219:6667 2808257 ETPRO MALWARE Backdoor.Win32.Delf.ars IRC Checkin Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

Flow SID Message
TCP 192.168.168.229:49234 -> 23.228.66.219:6667 2002028 ET CHAT IRC PONG response
TCP 192.168.168.229:49237 -> 23.228.66.219:6667 2002028 ET CHAT IRC PONG response
TCP 192.168.168.229:49238 -> 23.228.66.219:6667 2002028 ET CHAT IRC PONG response
TCP 23.228.66.219:6667 -> 192.168.168.229:49239 2812135 ETPRO POLICY Possible IRC Botnet Activity - Throttled Connection
Cuckoo

We're processing your submission... This could take a few seconds.