NetWork | ZeroBOX

Network Analysis

IP Address Status Action
164.124.101.2 Active Moloch
184.168.131.241 Active Moloch
23.234.7.122 Active Moloch
34.102.136.180 Active Moloch
34.80.190.141 Active Moloch
67.205.10.140 Active Moloch
POST 0 http://www.792argonne.com/n84e/
REQUEST
RESPONSE
GET 301 http://www.792argonne.com/n84e/?s0=DFZFTQHbXlya/MeaUFAazqs5HaS9PDJCmOYPBYguisCI4Vi6jG07nsAfhM9aFpcU+h3ZeOvL&CZ=7nH8XRk
REQUEST
RESPONSE
POST 404 http://www.betterhealthdc.com/n84e/
REQUEST
RESPONSE
GET 404 http://www.betterhealthdc.com/n84e/?s0=HpDyM7h5S8k83y8yqRedKYUfYoom3rvCxt/61BOuhsxa8LZ1DHJJwbq3je7qCSJdcJE1pbe9&CZ=7nH8XRk
REQUEST
RESPONSE
POST 405 http://www.notemanches.com/n84e/
REQUEST
RESPONSE
GET 403 http://www.notemanches.com/n84e/?s0=t6cJ++5ur6LyOWHVfvSSg1kOqj+5LkQnu0xiLqduvq4gQlmcvj2tgZjJWmh2P/ItDCI8JQg1&CZ=7nH8XRk
REQUEST
RESPONSE
POST 0 http://www.browbabelondon.com/n84e/
REQUEST
RESPONSE
GET 301 http://www.browbabelondon.com/n84e/?s0=iN/2jpDVItD0PjH3kQlCvYGpp+lZ4fRxObDvETofyrxd1QZoKdP5K/qHZNaGThNBJIIcYPFv&CZ=7nH8XRk
REQUEST
RESPONSE
POST 0 http://www.conectaragora.com/n84e/
REQUEST
RESPONSE
GET 301 http://www.conectaragora.com/n84e/?s0=p6i+kRTznlIfp8/7XMyecgcPSEfEpCNZNLU/042ESd3JmDRQsTR5UXzjOO9R4eeSQMVHZgcS&CZ=7nH8XRk
REQUEST
RESPONSE
POST 405 http://www.scorchonerecords.com/n84e/
REQUEST
RESPONSE
GET 403 http://www.scorchonerecords.com/n84e/?s0=AAar8/QTt3rWpEU75zSnopAP9jFchFx03LuP9S6n7N0ZyqjMic65prikiu4NCiYQqXEz50yr&CZ=7nH8XRk
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49208 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 67.205.10.140:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 67.205.10.140:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 67.205.10.140:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 184.168.131.241:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 184.168.131.241:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 184.168.131.241:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 184.168.131.241:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 184.168.131.241:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 184.168.131.241:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 34.80.190.141:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 34.80.190.141:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 34.80.190.141:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts