Analysis

Category Package Started Completed Duration Log
PCAP 2020-03-09 13:07:57 2020-03-09 13:07:57 0 seconds Show Log

    

MalScore

0.0

Benign


Signatures

No signatures

Hosts

Direct IP Country Name
Y 216.58.200.46 [VT] United States
Y 216.239.36.117 [VT] United States
Y 203.208.50.89 [VT] China
Y 203.208.50.56 [VT] China
Y 172.217.160.110 [VT] United States
Y 101.37.29.145 [VT] China
Y ff02::1:ff11:f0a5 [VT] unknown
Y ff02::fb [VT] unknown

DNS

Name Response Post-Analysis Lookup
_companion-link._tcp.local [VT]

Hosts

Direct IP Country Name
Y 216.58.200.46 [VT] United States
Y 216.239.36.117 [VT] United States
Y 203.208.50.89 [VT] China
Y 203.208.50.56 [VT] China
Y 172.217.160.110 [VT] United States
Y 101.37.29.145 [VT] China
Y ff02::1:ff11:f0a5 [VT] unknown
Y ff02::fb [VT] unknown

TCP

Source Source Port Destination Destination Port
192.168.0.29 57189 172.217.160.110 443
192.168.0.29 57195 192.168.0.17 3260
192.168.0.29 56988 203.208.50.56 443
192.168.0.29 54664 203.208.50.89 443
192.168.0.29 57183 216.239.36.117 443
192.168.0.29 57184 216.239.36.117 443
192.168.0.29 57177 216.58.200.46 443
192.168.0.29 57178 216.58.200.46 443

UDP

Source Source Port Destination Destination Port
fe80::8d:6e08:db0c:7116 5353 ff02::fb 5353
192.168.0.1 1900 239.255.255.250 1900
192.168.0.16 3389 192.168.0.29 60764
192.168.0.24 5353 224.0.0.251 5353
192.168.0.29 12000 101.37.29.145 1089
192.168.0.29 60765 192.168.0.16 3389

DNS

Name Response Post-Analysis Lookup
_companion-link._tcp.local [VT]

HTTP Requests

No HTTP requests performed.

SMTP traffic

No SMTP traffic performed.

IRC traffic

No IRC requests performed.

ICMP traffic

No ICMP traffic performed.

CIF Results

No CIF Results

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Suricata HTTP

No Suricata HTTP

Sorry! No dropped Suricata Extracted files.

JA3

No JA3 hashes found.

Sorry! No dropped files.
Sorry! No CAPE files.
Sorry! No process dumps.

Comments



No comments posted

Processing ( 0.071 seconds )

  • 0.042 NetworkAnalysis
  • 0.021 CAPE
  • 0.006 AnalysisInfo
  • 0.002 Debug

Signatures ( 0.076 seconds )

  • 0.016 ransomware_files
  • 0.007 antiav_detectreg
  • 0.007 ransomware_extensions
  • 0.006 infostealer_ftp
  • 0.003 persistence_autorun
  • 0.003 antiav_detectfile
  • 0.003 infostealer_bitcoin
  • 0.003 infostealer_im
  • 0.003 infostealer_mail
  • 0.002 cerber_behavior
  • 0.002 browser_security
  • 0.002 ie_martian_children
  • 0.002 masquerade_process_name
  • 0.002 network_torgateway
  • 0.001 tinba_behavior
  • 0.001 rat_nanocore
  • 0.001 betabot_behavior
  • 0.001 antianalysis_detectfile
  • 0.001 antianalysis_detectreg
  • 0.001 antivm_vbox_files
  • 0.001 antivm_vbox_keys
  • 0.001 geodo_banking_trojan
  • 0.001 bot_drive2
  • 0.001 disables_browser_warn
  • 0.001 modify_security_center_warnings
  • 0.001 modify_uac_prompt
  • 0.001 persistence_shim_database
  • 0.001 recon_fingerprint
  • 0.001 stealth_hiddenreg

Reporting ( 0.0 seconds )

Task ID 129992
Mongo ID 5e664029f45a62209b882888
Cuckoo release 1.3-CAPE
Delete