NetWork | ZeroBOX

IP Address	Status	Action
129.226.160.219	Active	Moloch
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch
182.50.132.242	Active	Moloch
188.93.150.60	Active	Moloch
198.185.159.145	Active	Moloch
23.227.38.74	Active	Moloch
23.95.122.25	Active	Moloch
34.102.136.180	Active	Moloch
52.58.78.16	Active	Moloch
72.251.224.90	Active	Moloch

Name	Response	Post-Analysis Lookup
www.frotaconceitos.com	CNAME shops.myshopify.com CNAME frotaconceitos.myshopify.com A 23.227.38.74	23.227.38.74
www.halostreams.net
www.forrealmodels.com	A 188.93.150.60	188.93.150.60
www.akerii.com	A 72.251.224.90	72.251.224.90
www.relaxxation.com	A 52.58.78.16	52.58.78.16
www.rivcodevelopment.com	CNAME rivcodevelopment.com A 182.50.132.242	182.50.132.242
www.buckhead-meat.com	A 34.102.136.180 CNAME buckhead-meat.com	34.102.136.180
www.gailrichardson.com	A 52.58.78.16	52.58.78.16
www.xn--jpr220deud640b.com	A 129.226.160.219 CNAME xg219.dongfenglishen.cn	129.226.160.219
www.bhcsva.com
www.warriornotesgolbalprayer.com	A 34.102.136.180 CNAME warriornotesgolbalprayer.com	34.102.136.180
www.pds-navi.com
www.thebluefishhotel.net	A 198.49.23.145 A 198.185.159.145 A 198.185.159.144 CNAME ext-sq.squarespace.com A 198.49.23.144	198.185.159.145
www.graniteinaminute.com	CNAME graniteinaminute.com A 182.50.132.242	182.50.132.242
www.startrekepisode.com	A 34.102.136.180 CNAME startrekepisode.com	34.102.136.180

TCP Requests

UDP Requests

GET 200 http://23.95.122.25/c/vbc.exe

POST 502 http://www.thebluefishhotel.net/qjnt/

GET 400 http://www.thebluefishhotel.net/qjnt/?5j=QMUGPevhnI2Yp74JHEVzH6HtR6H2zoEQzpkVeMV2m2AjEhovI/wxUE2mGeKCbnOUy7J9Z//U&vTdDF=LJBx

POST 0 http://www.forrealmodels.com/qjnt/

GET 0 http://www.forrealmodels.com/qjnt/?5j=/8UA4kKoPYWid4Wy4SiZil89tJjdT7ic7hTrtZ5fAe41kMJ49sOOTLg7IOgO80aghp25g4RJ&vTdDF=LJBx

POST 0 http://www.frotaconceitos.com/qjnt/

GET 403 http://www.frotaconceitos.com/qjnt/?5j=SklQbBNIGDp60jmvc81YaO0+TakJjqFF7kfS9N7pp+kjm4De+jDioVGollGezL8QEhW81teu&vTdDF=LJBx

POST 405 http://www.startrekepisode.com/qjnt/

GET 403 http://www.startrekepisode.com/qjnt/?5j=5+BnPckFTRrJGxaMVUv0BF1FKPa8eJDIfTmAxOSqxwEOI5f2tl64h5cJxkg2lQOsq3TBX7Br&vTdDF=LJBx

POST 400 http://www.graniteinaminute.com/qjnt/

GET 400 http://www.graniteinaminute.com/qjnt/?5j=Kc40ChrvGMsz5sDUgJdI1Tm80ndRwqOobrZe5CnH/KVtq0OHhWuXcnL+C6x+hGBLT8rXGqGg&vTdDF=LJBx

POST 404 http://www.xn--jpr220deud640b.com/qjnt/

GET 404 http://www.xn--jpr220deud640b.com/qjnt/?5j=jCTS+G1v0GO0ffaNHB4bN1x+uxcHkkGvZyQiwKE+/XJ/MeCy3/lhGRbiqne2xOkH/Blgq97x&vTdDF=LJBx

POST 405 http://www.warriornotesgolbalprayer.com/qjnt/

GET 403 http://www.warriornotesgolbalprayer.com/qjnt/?5j=NZEjDeTbQWI4t+jLVj6ckcPfHkTvqBwW1gJjjcociDWZiHYNHkrr42q5Qu5MGWq/DbzHTKzP&vTdDF=LJBx

POST 301 http://www.akerii.com/qjnt/

GET 301 http://www.akerii.com/qjnt/?5j=kSZZl6jWs3Sc3KX4sFYto2o1JEu4hGi+VMhwGPIJktQ5K/I5FgrvGI5WQKi2EBcGxzW2rAmT&vTdDF=LJBx

POST 400 http://www.rivcodevelopment.com/qjnt/

GET 400 http://www.rivcodevelopment.com/qjnt/?5j=8NBAzZEp5T2EoF9wMDQ69YhjG3fhuSs/Y3qkwEtmFVQU29n+5biQRN67qVAa42W8gpsiaP+Q&vTdDF=LJBx

POST 410 http://www.gailrichardson.com/qjnt/

GET 410 http://www.gailrichardson.com/qjnt/?5j=cQpYuVHVGObCoOy3oJObHgw0bCNAclVj5U/7sRdD/qRSo/tXEB2YKGAusTd/rcUBeGIQZ61D&vTdDF=LJBx

POST 410 http://www.relaxxation.com/qjnt/

GET 410 http://www.relaxxation.com/qjnt/?5j=mxaFhsYpdbWAcRjreClqDIL9OHFKPqnw/WaD4R8v0Y7MiHTOLhCg3x68N9MAlpNWynvCyQkZ&vTdDF=LJBx

POST 405 http://www.buckhead-meat.com/qjnt/

GET 403 http://www.buckhead-meat.com/qjnt/?5j=/eERDYDYg8Pjpk/w148+Jv3JxRRGqAllXY9DrwYjMBHW71fIc6WywKuPNHthuS6BfUUI+/zo&vTdDF=LJBx

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49805 -> 23.95.122.25:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 192.168.56.102:49805 -> 23.95.122.25:80	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	Potentially Bad Traffic
TCP 23.95.122.25:80 -> 192.168.56.102:49805	2022050	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1	A Network Trojan was detected
TCP 23.95.122.25:80 -> 192.168.56.102:49805	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 23.95.122.25:80 -> 192.168.56.102:49805	2022051	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2	A Network Trojan was detected
TCP 23.95.122.25:80 -> 192.168.56.102:49805	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.102:49813 -> 198.185.159.145:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49813 -> 198.185.159.145:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49813 -> 198.185.159.145:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49817 -> 23.227.38.74:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49817 -> 23.227.38.74:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49817 -> 23.227.38.74:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49835 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49835 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49835 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49833 -> 52.58.78.16:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49833 -> 52.58.78.16:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49833 -> 52.58.78.16:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49815 -> 188.93.150.60:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49815 -> 188.93.150.60:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49815 -> 188.93.150.60:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49829 -> 182.50.132.242:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49829 -> 182.50.132.242:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49829 -> 182.50.132.242:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49821 -> 182.50.132.242:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49821 -> 182.50.132.242:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49821 -> 182.50.132.242:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49831 -> 52.58.78.16:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49831 -> 52.58.78.16:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49831 -> 52.58.78.16:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49827 -> 72.251.224.90:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49819 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49827 -> 72.251.224.90:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49819 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49827 -> 72.251.224.90:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49819 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49823 -> 129.226.160.219:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49823 -> 129.226.160.219:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49823 -> 129.226.160.219:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49825 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49825 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49825 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts