NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.16.13.194 Active Moloch
160.153.137.40 Active Moloch
164.124.101.2 Active Moloch
172.67.138.177 Active Moloch
198.54.117.212 Active Moloch
52.58.78.16 Active Moloch
205.185.123.144 Active Moloch
GET 301 http://www.cyrilgraze.com/p2io/?AlB=PONkgH6OT+IdHpvpbj4YyU3gBn/U0y1OFS1Y8BXnr3YdY2x3tUozsMLieTk0sG+frQWfUBsy&ark=tXIxBh8PvLyhF
REQUEST
RESPONSE
GET 302 http://www.procircleacademy.com/p2io/?AlB=tgVoMP8jv8oJh0LH0MPWwDnGYGbnfEGTJ+yRL/Ijcc1+MHyU0MyQxKIFLUwq3WzUPcz2/uvN&ark=tXIxBh8PvLyhF
REQUEST
RESPONSE
GET 302 http://www.shopihy.com/p2io/?AlB=Ei6RqbmvJXwd1KhoWyb/BZtLNDk4B448l51n8Zz8P/g/u3IBdZc5bHR/QCXBboISRM182550&ark=tXIxBh8PvLyhF
REQUEST
RESPONSE
GET 0 http://www.boogerstv.com/p2io/?AlB=fW2NkW2hr8hPz8wwd/m+egXTc5dWq8qtohIQX9xRv3Snfsyr1ZmLXS10rFsoitOMGqtVMq3V&ark=tXIxBh8PvLyhF
REQUEST
RESPONSE
GET 410 http://www.newmopeds.com/p2io/?AlB=bSK1RxPLajIrf62nOJ2LeA3okZHmhG3V4GBmTatllgIVkFsFULHDN0cIL5FJcRS/4igqPa1G&ark=tXIxBh8PvLyhF
REQUEST
RESPONSE

ICMP traffic

Source Destination ICMP Type Data
192.168.56.102 164.124.101.2 3
192.168.56.102 164.124.101.2 3
192.168.56.102 164.124.101.2 3

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49164 -> 172.67.138.177:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49164 -> 172.67.138.177:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49164 -> 172.67.138.177:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49165 -> 104.16.13.194:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49165 -> 104.16.13.194:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49165 -> 104.16.13.194:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49166 -> 160.153.137.40:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49166 -> 160.153.137.40:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49166 -> 160.153.137.40:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 52.58.78.16:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 52.58.78.16:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 52.58.78.16:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 198.54.117.212:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 198.54.117.212:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 198.54.117.212:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts