NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.252.121.237 Active Moloch
164.124.101.2 Active Moloch
3.112.233.112 Active Moloch
34.102.136.180 Active Moloch
52.14.32.15 Active Moloch
GET 200 http://3.112.233.112/www/vbc.exe
REQUEST
RESPONSE
POST 0 http://www.redudiban.com/p2io/
REQUEST
RESPONSE
GET 500 http://www.redudiban.com/p2io/?1bw=lG9Y6vALifV69L5nwZMaSDuac40TgmoMbDmTo0RVe6GC0eaU+z9H3LThoKEFdKrpsqSNHxEr&LZa0=kJEXPjV
REQUEST
RESPONSE
POST 0 http://www.painhut.com/p2io/
REQUEST
RESPONSE
GET 404 http://www.painhut.com/p2io/?1bw=403u/w6DmQ0SdXY5uvN4cykoFcXgffqxcXVyEVQEiHIwKr5fFLVOKqQhRyqqhxyR2hkDTO+v&LZa0=kJEXPjV
REQUEST
RESPONSE
POST 405 http://www.thesoulrevitalist.com/p2io/
REQUEST
RESPONSE
GET 403 http://www.thesoulrevitalist.com/p2io/?1bw=ywi4HDlC8ElSOMEyK6H+rd6B6cynTULkanOSXBUPYg06e2wPUHpv6wPun14JIO+5lIaxxIkr&LZa0=kJEXPjV
REQUEST
RESPONSE

ICMP traffic

Source Destination ICMP Type Data
192.168.56.101 164.124.101.2 3
192.168.56.101 164.124.101.2 3
192.168.56.101 164.124.101.2 3
192.168.56.101 164.124.101.2 3
192.168.56.101 164.124.101.2 3
192.168.56.101 164.124.101.2 3

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49222 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49222 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49222 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 3.112.233.112:80 2016141 ET INFO Executable Download from dotted-quad Host A Network Trojan was detected
TCP 192.168.56.101:49204 -> 3.112.233.112:80 2019714 ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile Potentially Bad Traffic
TCP 3.112.233.112:80 -> 192.168.56.101:49204 2022050 ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 A Network Trojan was detected
TCP 3.112.233.112:80 -> 192.168.56.101:49204 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 3.112.233.112:80 -> 192.168.56.101:49204 2022051 ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 A Network Trojan was detected
TCP 3.112.233.112:80 -> 192.168.56.101:49204 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.101:49220 -> 52.14.32.15:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49220 -> 52.14.32.15:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49220 -> 52.14.32.15:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 104.252.121.237:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 104.252.121.237:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 104.252.121.237:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts