NetWork | ZeroBOX

Network Analysis

IP Address Status Action
154.94.101.170 Active Moloch
164.124.101.2 Active Moloch
198.57.247.186 Active Moloch
217.160.0.234 Active Moloch
34.102.136.180 Active Moloch
64.98.145.30 Active Moloch
POST 0 http://www.toughcookiemasks.store/a3ea/
REQUEST
RESPONSE
GET 200 http://www.toughcookiemasks.store/a3ea/?tVm4=C8AXzH85EW6bcksLHaxF/KT8Irp4AtcdmYJKzOvgBn+W3BKccZ5NKp4N2sSXLniiTrul85mh&U48Hj=NtetP010Fhk0eBmp
REQUEST
RESPONSE
POST 0 http://www.njzhongqiang.com/a3ea/
REQUEST
RESPONSE
GET 0 http://www.njzhongqiang.com/a3ea/?tVm4=7B5Y82ijZowLi65LlrOdfRJrA23b3y8A1iFQ94gfFtk3rWCbyNy7KEk3A3Kfr610vJsDD0tA&U48Hj=NtetP010Fhk0eBmp
REQUEST
RESPONSE
POST 0 http://www.buscosol.com/a3ea/
REQUEST
RESPONSE
GET 404 http://www.buscosol.com/a3ea/?tVm4=lRsiICaqtm2zzUnhXLfpLD7Q/+UaV/rCUiwMIjEIEqTTgaJvQmAUsMmIJXJ+m6+joKtZimwp&U48Hj=NtetP010Fhk0eBmp
REQUEST
RESPONSE
POST 405 http://www.californiatonashville.com/a3ea/
REQUEST
RESPONSE
GET 403 http://www.californiatonashville.com/a3ea/?tVm4=8H22mTWKiFm53ygv7BpxdD0DMJSQry+Qjl67+C0ZF0kPq5HYZo9BXDHD5wcfLRsUUtyCBRrI&U48Hj=NtetP010Fhk0eBmp
REQUEST
RESPONSE
POST 200 http://www.partypacktv.net/a3ea/
REQUEST
RESPONSE
GET 200 http://www.partypacktv.net/a3ea/?tVm4=mKo1Qg6HqSIcsN4zQXcvrJa2ES1RBdIFriO8tlFo7dt3X/kB1ulnY9q1GBPnIXxgJBBZKIeM&U48Hj=NtetP010Fhk0eBmp
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49204 -> 64.98.145.30:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 64.98.145.30:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 64.98.145.30:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 217.160.0.234:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 217.160.0.234:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 217.160.0.234:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 154.94.101.170:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 154.94.101.170:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 154.94.101.170:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 198.57.247.186:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 198.57.247.186:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 198.57.247.186:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts