NetWork | ZeroBOX

IP Address	Status	Action
104.21.59.61	Active	Moloch
142.250.204.46	Active	Moloch
154.127.54.62	Active	Moloch
162.159.134.233	Active	Moloch
164.124.101.2	Active	Moloch
172.245.119.43	Active	Moloch
202.210.8.155	Active	Moloch
34.102.136.180	Active	Moloch

Name	Response	Post-Analysis Lookup
www.langers.email
www.applicableturnout.club	A 172.67.216.157 A 104.21.59.61	104.21.59.61
www.salivasolve.com	A 34.102.136.180 CNAME salivasolve.com	34.102.136.180
google.com	A 142.250.204.46	172.217.175.46
www.formatohd.xyz	CNAME formatohd.xyz A 154.127.54.62	154.127.54.62
www.wanpoo1.com	A 202.210.8.155	202.210.8.155
cdn.discordapp.com	A 162.159.135.233 A 162.159.134.233 A 162.159.129.233 A 162.159.130.233 A 162.159.133.233	162.159.134.233

TCP Requests

UDP Requests

GET 200 https://cdn.discordapp.com/attachments/858793322087710753/863898136854003722/me.jpg

GET 200 http://172.245.119.43/d/sharp.exe

GET 404 http://www.wanpoo1.com/jn7g/?xVMtB8oh=f1txrUsdtgvlRZfFl/3qwcMnsDpxot63EHJ4FRyTveGHsTWl8LNXqx1DgUF91kvu8hbR5MKR&1bw=L6AdkJ8PtTAtvfC0

GET 403 http://www.salivasolve.com/jn7g/?xVMtB8oh=LjSwbA7FwlWPZY8aZVplIy66ddjBjMzLn1RIC02GaXcy/I7AmoIAjniGIlflMFRohJW66HhH&1bw=L6AdkJ8PtTAtvfC0

GET 301 http://www.formatohd.xyz/jn7g/?xVMtB8oh=rBF8etPQjoWBTHIpYleE6n5rMk1/4doO857OEMSviIYg2eKF3uhinNCweNEOV5ZmhoRIN+nm&1bw=L6AdkJ8PtTAtvfC0

ICMP traffic

Source	Destination	ICMP Type	Data
192.168.56.101	142.250.204.46	8	abcdefghijklmnopqrstuvwabcdefghi
142.250.204.46	192.168.56.101	0	abcdefghijklmnopqrstuvwabcdefghi

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49201 -> 172.245.119.43:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 172.245.119.43:80 -> 192.168.56.101:49201	2022050	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1	A Network Trojan was detected
TCP 172.245.119.43:80 -> 192.168.56.101:49201	2014819	ET INFO Packed Executable Download	Misc activity
TCP 192.168.56.101:49204 -> 162.159.134.233:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49208 -> 202.210.8.155:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 202.210.8.155:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 202.210.8.155:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 154.127.54.62:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 154.127.54.62:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 154.127.54.62:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 154.127.54.62:80	2031088	ET HUNTING Request to .XYZ Domain with Minimal Headers	Potentially Bad Traffic
TCP 192.168.56.101:49210 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49219 -> 104.21.59.61:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49219 -> 104.21.59.61:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49219 -> 104.21.59.61:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 172.245.119.43:80 -> 192.168.56.101:49201	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 172.245.119.43:80 -> 192.168.56.101:49201	2022051	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2	A Network Trojan was detected
TCP 172.245.119.43:80 -> 192.168.56.101:49201	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49204 162.159.134.233:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2	C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	a6:26:df:21:b9:4f:a7:fb:ae:8d:87:ce:fb:7d:2b:c6:50:8b:ff:da

Snort Alerts

No Snort Alerts